CVE-2026-111959Not scored
Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads
Apache Software Foundation · Apache Arrow Rust
Not in CISA KEVVendor fix available
No EPSS score yet. The score appears once FIRST publishes it.
Not scored yet. NVD has not published a CVSS score.
DescriptionNVD
Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array. Users are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 3 Nov.
- Apache fixes eight high risk flaws across three projectsSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.