CVE-2026-111959
Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads
Out-of-bounds read vulnerability in Apache Arrow Rust (arrow crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.
Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.
Users are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads
Out-of-bounds read vulnerability in Apache Arrow Rust (arrow crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.
Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.
Users are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.
- Record
CVE-2026-111959- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-125, CWE-20
- Updated
- 2026-11-06
EUVDEUVD-2026-115182
Out-of-bounds read vulnerability in Apache Arrow Rust (arrow crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.
Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.
Users are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.
- Record
EUVD-2026-115182- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-gqmm-qrjq-4c7h No score
Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0...
Out-of-bounds read vulnerability in Apache Arrow Rust (arrow crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.
Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.
Users are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.
- Record
GHSA-gqmm-qrjq-4c7h- Weakness
- CWE-20
- Updated
- 2026-11-03
NVD
Out-of-bounds read vulnerability in Apache Arrow Rust (arrow crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.
Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.
Users are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.
- Record
CVE-2026-111959- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-20, CWE-125
- Updated
- 2026-11-06
OSVRUSTSEC-2026-0442 No score
Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads
Improper validation of RunEndEncoded arrays via ArrayData::validate_values can
allow reading data beyond the bounds of the child values array when reading the
last value via APIs such as TypedRunArray::value.
Patched versions now properly validate the contents of RunEndEncoded arrays to prevent allowing reading out of bounds of the specified array data.
Credit to Adam Korczynski of Ada Logics for reporting this and Anthropic for finding this.
- Record
RUSTSEC-2026-0442- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
arrow-datacrates.io |
33.0.0 up to 57.3.2, 58.0.0 up to 58.4.1, 59.0.0 up to 59.3.2, 60.0.0 up to 60.1.0 | 57.3.258.4.159.3.260.1.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| severity | CVE List | |
| affected, aliases, facts, published, references | EUVD, OSV | |
| references | CVE List, GitHub Advisories, NVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-111959 is a critical vulnerability (CVSS 9.1) in Apache Software Foundation Arrow Rust, published November 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.55%, the 46th percentile. Fixed in arrow-data 57.3.2.