Loading vulnerability…
Out-of-bounds read in Apache Arrow Rust RunEndEncoded validation
CVE-2026-111959 is an out-of-bounds read vulnerability in Apache Arrow Rust's arrow and arrow-data crates. ArrayData::validate_values incompletely validates RunEndEncoded arrays, allowing malformed relationships between run-end positions and child values to pass validation. Subsequent access to the last value through APIs such as TypedRunArray::value can read beyond the bounds of the child values array. Affected versions are 33.0.0–57.3.1, 58.0.0–58.4.0, 59.0.0–59.3.1, and 60.0.0.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Malformed RunEndEncoded arrays can trigger out-of-bounds memory reads, violating memory safety and potentially exposing memory outside the intended child values array. Actual exposure depends on how the application processes and exposes the resulting data. No working exploit, demonstrated data theft, or application takeover is established.
Patch, then assume compromise.
Upgrade affected Arrow Rust dependencies to 57.3.2, 58.4.1, 59.3.2, or 60.1.0, or a later fixed release on the corresponding branch. Identify direct and transitive arrow and arrow-data dependencies, rebuild applications with corrected dependencies, and redeploy the resulting executables or containers. Verify the dependency versions used by deployed builds; updating operating-system packages or rebuilding containers around unchanged application binaries does not replace embedded vulnerable Rust code.
No public exploits tracked yet. Mallory keeps watching.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.