GHSA-wv8j-m3hx-924j
Arrow2 allows out of bounds access in public safe API
GHSA-wv8j-m3hx-924j is a high vulnerability (CVSS 8.7) in arrow2, published April 24, 2025. No source lists public exploit code. No source names a fixed version.
- Severity
- 8.7 HighCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Rows::row_unchecked() allows out of bounds access to the underlying buffer without sufficient checks.
The arrow2 crate is no longer maintained, so there are no plans to fix this issue. Users are advised to migrate to the arrow crate, instead.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Affected packages
What each source reports
GitHub Advisories Score used
Arrow2 allows out of bounds access in public safe API
Rows::row_unchecked() allows out of bounds access to the underlying buffer without sufficient checks.
The arrow2 crate is no longer maintained, so there are no plans to fix this issue. Users are advised to migrate to the arrow crate, instead.
- Record
GHSA-wv8j-m3hx-924j- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-119
- Updated
- 2026-11-02
OSV
Arrow2 allows out of bounds access in public safe API
Rows::row_unchecked() allows out of bounds access to the underlying buffer without sufficient checks.
The arrow2 crate is no longer maintained, so there are no plans to fix this issue. Users are advised to migrate to the arrow crate, instead.
- Record
GHSA-wv8j-m3hx-924j- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-119
- Updated
- 2026-11-02
OSVRUSTSEC-2025-0038No score
Out of bounds access in public safe API
Rows::row_unchecked() allows out of bounds access to the underlying
buffer without sufficient checks.
The arrow2 crate is no longer maintained, so there are no plans to fix this issue. Users are advised to migrate to the arrow crate, instead.
- Record
RUSTSEC-2025-0038- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.