open-source-dependency-vulnerability

Apache Arrow Rust Fixes Out-of-Bounds Read in RunEndEncoded Array Validation

Vulnerability Disclosure · 2 sources · Updated 2d ago · First seen Nov 4, 2026

Apache patched CVE-2026-111959, a moderate-severity out-of-bounds read vulnerability in the Rust implementation of Apache Arrow’s arrow-data package. Incomplete validation of RunEndEncoded arrays allows ArrayData::validate_values to accept malformed data, after which APIs such as TypedRunArray::value can read beyond the child values buffer when accessing the last value. The RustSec advisory, RUSTSEC-2026-0442, credits Anthropic with discovery and Adam Korczynski of Ada Logics with reporting. The disclosure provides no working exploit or evidence of demonstrated data theft or application takeover.

Fixes strengthen array validation and are available in 60.1.0, 59.3.2, 58.4.1, and 57.3.2 on their respective release branches. Organizations should identify affected direct and transitive arrow and arrow-data dependencies, update to a corrected release, and rebuild and redeploy dependent applications. Remediation should be verified in the running application; operating-system or container updates alone may leave vulnerable library code in deployed builds.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Nov 2, 2026 – Nov 5, 2026

Nov 5, 20263d ago
RustSec issues RUSTSEC-2026-0442 for arrow-data
RustSec issued an advisory classifying the vulnerability as unsoundness involving memory exposure and an out-of-bounds read. It documented that invalid arrays accepted by ArrayData::validate_values can cause TypedRunArray::value to read beyond the child values array.
RUSTSEC-2026-0442: arrow-data: Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads › RustSec Advisory Database
Reported Nov 4, 20264d ago
Apache releases fixes across four Arrow Rust branches
Apache released versions 60.1.0, 59.3.2, 58.4.1, and 57.3.2 with stronger RunEndEncoded array validation to prevent out-of-bounds reads. Applications incorporating affected Rust code require rebuilding and redeployment with corrected dependencies.
Apache Arrow Rust Update Fixes Moderate Out of Bounds Read
Nov 2, 20266d ago
Arrow maintainers open discussion on future security-backport coverage
Jeffrey Vo opened a discussion about future security-backport coverage on the disclosure date. Andrew Lamb noted the considerable effort required for four backports and suggested supporting two or three major releases for future critical issues, but no policy was adopted.
Apache Arrow Rust Update Fixes Moderate Out of Bounds Read
Nov 2, 20266d ago
Apache discloses out-of-bounds read in Arrow Rust
On November 2, Apache disclosed moderate-severity CVE-2026-111959: incomplete validation of RunEndEncoded arrays can allow reads beyond the values buffer. Apache credited Anthropic with discovery and Adam Korczynski of Ada Logics with reporting; the disclosure provided no working exploit or demonstrated compromise.
Apache Arrow Rust Update Fixes Moderate Out of Bounds Read

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Out-of-bounds read in Apache Arrow Rust RunEndEncoded validation (CVE-2026-111959)

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

RustsecNews · Nov 5, 2026

RUSTSEC-2026-0442: arrow-data: Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads › RustSec Advisory DatabaseOpen source ↗

LinuxsecurityNews · Nov 4, 2026

Apache Arrow Rust Update Fixes Moderate Out of Bounds ReadOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

open-source-dependency-vulnerability

Apache Arrow Rust Fixes Out-of-Bounds Read in RunEndEncoded Array Validation

Vulnerability Disclosure · 2 sources · Updated 2d ago · First seen Nov 4, 2026

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Nov 2, 2026 – Nov 5, 2026

Nov 5, 20263d ago
RustSec issues RUSTSEC-2026-0442 for arrow-data
RustSec issued an advisory classifying the vulnerability as unsoundness involving memory exposure and an out-of-bounds read. It documented that invalid arrays accepted by ArrayData::validate_values can cause TypedRunArray::value to read beyond the child values array.
RUSTSEC-2026-0442: arrow-data: Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads › RustSec Advisory Database
Reported Nov 4, 20264d ago
Apache releases fixes across four Arrow Rust branches
Apache released versions 60.1.0, 59.3.2, 58.4.1, and 57.3.2 with stronger RunEndEncoded array validation to prevent out-of-bounds reads. Applications incorporating affected Rust code require rebuilding and redeployment with corrected dependencies.
Apache Arrow Rust Update Fixes Moderate Out of Bounds Read
Nov 2, 20266d ago
Arrow maintainers open discussion on future security-backport coverage
Jeffrey Vo opened a discussion about future security-backport coverage on the disclosure date. Andrew Lamb noted the considerable effort required for four backports and suggested supporting two or three major releases for future critical issues, but no policy was adopted.
Apache Arrow Rust Update Fixes Moderate Out of Bounds Read
Nov 2, 20266d ago
Apache discloses out-of-bounds read in Arrow Rust
On November 2, Apache disclosed moderate-severity CVE-2026-111959: incomplete validation of RunEndEncoded arrays can allow reads beyond the values buffer. Apache credited Anthropic with discovery and Adam Korczynski of Ada Logics with reporting; the disclosure provided no working exploit or demonstrated compromise.
Apache Arrow Rust Update Fixes Moderate Out of Bounds Read

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Out-of-bounds read in Apache Arrow Rust RunEndEncoded validation (CVE-2026-111959)

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

RustsecNews · Nov 5, 2026

RUSTSEC-2026-0442: arrow-data: Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads › RustSec Advisory DatabaseOpen source ↗

LinuxsecurityNews · Nov 4, 2026

Apache Arrow Rust Update Fixes Moderate Out of Bounds ReadOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Apache Arrow Rust Fixes Out-of-Bounds Read in RunEndEncoded Array Validation

How this story unfolded

RustSec issues RUSTSEC-2026-0442 for arrow-data

Apache releases fixes across four Arrow Rust branches

Arrow maintainers open discussion on future security-backport coverage

Apache discloses out-of-bounds read in Arrow Rust

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

Rust rkyv Flaws Let Malicious Archives Trigger Memory Safety Errors

Apache APR Utility apr_dbd_oracle SQL Injection Flaw Patched

Apache Fory Out-of-Bounds Read Flaw Affects Zero-Copy Java Deserialization

Apache Arrow Rust Fixes Out-of-Bounds Read in RunEndEncoded Array Validation

How this story unfolded

RustSec issues RUSTSEC-2026-0442 for arrow-data

Apache releases fixes across four Arrow Rust branches

Arrow maintainers open discussion on future security-backport coverage

Apache discloses out-of-bounds read in Arrow Rust

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

Rust rkyv Flaws Let Malicious Archives Trigger Memory Safety Errors

Apache APR Utility apr_dbd_oracle SQL Injection Flaw Patched

Apache Fory Out-of-Bounds Read Flaw Affects Zero-Copy Java Deserialization