Out-of-Bounds Read Vulnerability in Apache Arrow Rust

CVE-2026-111959

What is CVE-2026-111959?

An out-of-bounds read vulnerability exists in Apache Arrow Rust via improper validation of RunEndEncoded arrays in the ArrayData interface. This flaw permits unauthorized access to memory beyond the limits of the child values array, potentially leading to data leakage. Users are strongly advised to upgrade to versions 60.1.0, 59.3.2, 58.4.1, and 57.3.2 to mitigate this issue and enhance security.

References