Apache Arrow vulnerabilities

• andybalholm brotli, 7-zip p7zip, anthropic bun +34 more +36 more Out-of-Bounds Write in Google Brotli Decoder CVE-2026-111497 In KEVPublic exploitFix available EPSS 82.6% 9.2 CriticalApril 27, 2026
• apache arrow Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering CVE-2026-25087 Fix available 7.0 HighFebruary 17, 2026
• apache arrow, apache software foundation arrow r package +1 more Apache Arrow R package: Arbitrary code execution when loading a malicious data file CVE-2024-52338 Fix available 9.8 CriticalNovember 28, 2024
• apache arrow, apache software foundation arrow rust object store +1 more Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files CVE-2024-41178 Fix available 7.5 HighJuly 23, 2024
• apache pyarrow PyArrow, PyArrow: Arbitrary code execution when loading a malicious data file CVE-2023-47248 Public exploitFix available EPSS 14.5% 9.8 CriticalNovember 9, 2023
• apache arrow Missing Initialization of Resource in Apache Arrow CVE-2019-12408 Fix available 7.5 HighNovember 8, 2019
• apache arrow Missing Initialization of Resource in Apache Arrow CVE-2019-12410 Fix available 7.5 HighNovember 8, 2019