RUSTSEC-2026-0442: Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads

Q: What conditions are required for exploitation?

An attacker would need to cause the application to process a malformed RunEndEncoded array that passes the prior validation but has child values data too short for the last run-end value. The out-of-bounds read occurs when accessing the last value through APIs such as TypedRunArray::value.

Q: Which applications are most exposed?

Applications using the rust/arrow-data crate that accept, construct, deserialize, or otherwise process RunEndEncoded array data from untrusted sources are the most exposed. The provided information does not establish whether ordinary default usage creates malformed arrays.

Q: What should be done if patching cannot happen immediately?

Avoid processing untrusted RunEndEncoded arrays, or validate that run-end values do not permit indexing beyond the child values array before accessing array values. This mitigation follows the validation condition corrected by the patched versions.

Published Nov 2, 2026

Updated

Improper validation of RunEndEncoded arrays via ArrayData::validatevalues can allow reading data beyond the bounds of the child values array when reading the last value via APIs such as TypedRunArray::value.

Patched versions now properly validate the contents of RunEndEncoded arrays to prevent allowing reading out of bounds of the specified array data.

Credit to Adam Korczynski of Ada Logics for reporting this and Anthropic for finding this.

Affected Software

4 affected componentsFixes available

rust/arrow-data>=33.0.0<57.3.2

57.3.2

rust/arrow-data>=58.0.0<58.4.1

58.4.1

rust/arrow-data>=59.0.0<59.3.2

59.3.2

rust/arrow-data>=60.0.0<60.1.0

60.1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rust/arrow-data to a version that resolves this vulnerability.
Fixed in 57.3.2
Upgrade
Upgrade rust/arrow-data to a version that resolves this vulnerability.
Fixed in 58.4.1
Upgrade
Upgrade rust/arrow-data to a version that resolves this vulnerability.
Fixed in 59.3.2
Upgrade
Upgrade rust/arrow-data to a version that resolves this vulnerability.
Fixed in 60.1.0

Event History

Nov 2, 2026

Advisory Published

via OSV·12:00 PM

Data Sourced

via OSV·12:00 PM

DescriptionAffected Software

Frequently Asked Questions

What conditions are required for exploitation?

An attacker would need to cause the application to process a malformed RunEndEncoded array that passes the prior validation but has child values data too short for the last run-end value. The out-of-bounds read occurs when accessing the last value through APIs such as TypedRunArray::value.

Which applications are most exposed?

Applications using the rust/arrow-data crate that accept, construct, deserialize, or otherwise process RunEndEncoded array data from untrusted sources are the most exposed. The provided information does not establish whether ordinary default usage creates malformed arrays.

What should be done if patching cannot happen immediately?

Avoid processing untrusted RunEndEncoded arrays, or validate that run-end values do not permit indexing beyond the child values array before accessing array values. This mitigation follows the validation condition corrected by the patched versions.

RUSTSEC-2026-0442: Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required for exploitation?

Which applications are most exposed?

What should be done if patching cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

Which applications are most exposed?

What should be done if patching cannot happen immediately?