CVE-2026-111959: Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads

Published Nov 2, 2026

Updated

Out-of-bounds read vulnerability in Apache Arrow Rust (arrow crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.

Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.

Users are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.

Event History

Nov 2, 2026

CVE Published

via NVD·02:17 PM

Data Sourced

via NVD·02:17 PM

DescriptionWeakness

Frequently Asked Questions

Which Apache Arrow Rust versions should be treated as affected, and which versions contain the fix?

The issue affects the arrow crate from 33.0.0 through 57.3.1, 58.4.0, 59.3.1, and 60.0.0. Upgrade to 57.3.2, 58.4.1, 59.3.2, or 60.1.0.

What input path is involved in exploitation?

The vulnerable path is construction or handling of RunEndEncoded arrays through the ArrayData interface. Improper validation can cause reads beyond the bounds of the child values array.

CVE-2026-111959: Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads

Event History

Frequently Asked Questions

Which Apache Arrow Rust versions should be treated as affected, and which versions contain the fix?

What input path is involved in exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which Apache Arrow Rust versions should be treated as affected, and which versions contain the fix?

What input path is involved in exploitation?