---
id: CVE-2026-111959
title: >-
  Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of
  bounds reads
summary: >-
  Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from
  version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.




  Improper validation of RunEndEncoded arrays in the ArrayData interface can
  allow reading…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'
cvssSource: adp
cwe:
  - CWE-125
  - CWE-20
vendor: Apache Software Foundation
product: arrow
affected:
  - arrow >= 60.0.0 < 60.1.0
  - arrow >= 59.0.0 <= 59.3.1
  - arrow >= 58.0.0 <= 58.4.0
  - arrow >= 33.0.0 <= 57.3.1
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-06T18:35:18.470735Z'
published: '2026-11-02'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T18:35:40.676Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111959'
references:
  - url: 'https://lists.apache.org/thread.html/hnlrdk4w99b188w1zgjlctpwpg7y55o4'
  - url: 'https://crates.io/crates/arrow-data'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0442.html'
  - url: 'https://github.com/apache/arrow-rs/issues/11587'
  - url: 'https://www.openwall.com/lists/oss-security/2026/11/02/2'
tags:
  - cve.org
  - osv
  - rust
epss: 0.00554
epssPercentile: 0.46455
aliases:
  - RUSTSEC-2026-0442
  - GHSA-gqmm-qrjq-4c7h
ecosystem: rust
patched:
  - arrow-data 60.1.0
ingestedAt: '2026-11-05T15:13:27.899Z'
---

## Overview

Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.



Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.



Users are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.

## Affected

- `arrow >= 60.0.0 < 60.1.0`
- `arrow >= 59.0.0 <= 59.3.1`
- `arrow >= 58.0.0 <= 58.4.0`
- `arrow >= 33.0.0 <= 57.3.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-111959)

Affected packages:

- `arrow-data >= 60.0.0, < 60.1.0`

Patched in:

- `arrow-data 60.1.0`

Source: https://osv.dev/vulnerability/RUSTSEC-2026-0442