CVE-2023-47248
PyArrow, PyArrow: Arbitrary code execution when loading a malicious data file
Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).
This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.
It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon.
If it is not possible to upgrade, we provide a separate package pyarrow-hotfix that disables the vulnerability on older PyArrow versions. See https://pypi.org/project/pyarrow-hotfix/ for instructions.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).
This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.
It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon.
If it is not possible to upgrade, we provide a separate package pyarrow-hotfix that disables the vulnerability on older PyArrow versions. See https://pypi.org/project/pyarrow-hotfix/ for instructions.
- Record
CVE-2023-47248- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
CVE List No score
PyArrow, PyArrow: Arbitrary code execution when loading a malicious data file
Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).
This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.
It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon.
If it is not possible to upgrade, we provide a separate package pyarrow-hotfix that disables the vulnerability on older PyArrow versions. See https://pypi.org/project/pyarrow-hotfix/ for instructions.
- Record
CVE-2023-47248- Weakness
- CWE-502
- Updated
- 2026-11-02
EUVDEUVD-2023-0212
Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).
This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.
It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon.
If it is not possible to upgrade, we provide a separate package pyarrow-hotfix that disables the vulnerability on older PyArrow versions. See https://pypi.org/project/pyarrow-hotfix/ for instructions.
- Record
EUVD-2023-0212- CVSS
- 0.0 None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5wvp-7f3h-6wmm
PyArrow: Arbitrary code execution when loading a malicious data file
Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).
This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.
It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon.
If it is not possible to upgrade, maintainers provide a separate package pyarrow-hotfix that disables the vulnerability on older PyArrow versions. See https://pypi.org/project/pyarrow-hotfix/ for instructions.
- Record
GHSA-5wvp-7f3h-6wmm- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVGHSA-5wvp-7f3h-6wmm
PyArrow: Arbitrary code execution when loading a malicious data file
Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).
This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.
It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon.
If it is not possible to upgrade, maintainers provide a separate package pyarrow-hotfix that disables the vulnerability on older PyArrow versions. See https://pypi.org/project/pyarrow-hotfix/ for instructions.
- Record
GHSA-5wvp-7f3h-6wmm- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVROOT-APP-PYPI-CVE-2023-47248
CVE-2023-47248 in pyarrow - Patched by Root
Root has patched CVE-2023-47248 in the pyarrow package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-CVE-2023-47248- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVCLSA-2026-1778805964 No score
TuxCare security update for pyarrow (1 CVE)
TuxCare rebuilt pyarrow to address 1 CVE. Fixed in 12.0.1.post1+tuxcare.
- Record
CLSA-2026-1778805964- Updated
- 2026-11-02
OSV No score
PyArrow, PyArrow: Arbitrary code execution when loading a malicious data file
Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).
This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings.
It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon.
If it is not possible to upgrade, we provide a separate package pyarrow-hotfix that disables the vulnerability on older PyArrow versions. See https://pypi.org/project/pyarrow-hotfix/ for instructions.
- Record
CVE-2023-47248- Weakness
- CWE-502
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13431-1 No score
python310-pyarrow-14.0.1-2.1 on GA media
These are all security issues fixed in the python310-pyarrow-14.0.1-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13431-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13460-1 No score
python310-geopandas-0.14.1-1.1 on GA media
These are all security issues fixed in the python310-geopandas-0.14.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13460-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13480-1 No score
python310-pandas-2.1.3-1.1 on GA media
These are all security issues fixed in the python310-pandas-2.1.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13480-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11341-1 No score
python313-pandas-3.0.3-1.2 on GA media
These are all security issues fixed in the python313-pandas-3.0.3-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11341-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11616-1 No score
python313-geopandas-1.1.4-1.1 on GA media
These are all security issues fixed in the python313-geopandas-1.1.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11616-1- Updated
- 2026-11-02
OSVPYSEC-2023-238 No score
Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files).
- Record
PYSEC-2023-238- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pyarrowPyPI |
0.14.0 up to 14.0.1 | 14.0.1 |
pyarrowTuxCare:PyPI |
12.0.1 up to 12.0.1.post1+tuxcare | 12.0.1.post1+tuxcare |
pyarrowPyPI |
0.14.0 up to 14.0.1, plus listed versions 0.14.10.15.00.15.10.16.00.17.0 Show 20 moreShow less0.17.11.0.01.0.110.0.010.0.111.0.012.0.012.0.113.0.014.0.02.0.03.0.04.0.04.0.15.0.06.0.06.0.17.0.08.0.09.0.0 |
14.0.1 |
pyarrowRoot:PyPI |
before 6.0.1+aikido.3 | 6.0.1+aikido.3 |
python-pandasopenSUSE:Tumbleweed |
before 3.0.3-1.2 | 3.0.3-1.2 |
python-geopandasopenSUSE:Tumbleweed |
before 1.1.4-1.1 | 1.1.4-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | PyArrow Flight RPC - Remote Code Execution | |
| PoC in GitHub | Prodigysec/pyarrow-CVE-2023-47248 | 2025-12-27 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-47248 is a critical vulnerability (CVSS 9.8) in Apache Pyarrow, published November 9, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 14.5%, the 96th percentile. Fixed in pyarrow 14.0.1.
References
lists.apache.org/thread/yhy7tdfjf9hrl9vfrtzo8p2cyjq87v7n
github.com/apache/arrow/commit/f14170976372436ec1d03a724d8d3f3925484ecf
pypi.org/project/pyarrow-hotfix
lists.fedoraproject.org/archives/list/[email protected]/message/FR34AIPXVTMB3XPRU5ULV5HHWPMRE33X
Show 10 moreShow less
nvd.nist.gov/vuln/detail/CVE-2023-47248
cve.org/CVERecord?id=CVE-2023-47248
openwall.com/lists/oss-security/2023/11/08/7
conda-forge.org
suse.com/security/cve/CVE-2023-47248