Cyber ·
CVE-2026-111959: out-of-bounds read from improper RunEndEncoded array validation in Apache Arrow Rust
Moderate advisory on improper validation of RunEndEncoded arrays in the ArrayData interface of Apache Arrow Rust, allowing out-of-bounds reads in affected crate arrow version ranges from 33.0.0 through 60.0.0.
On 02 November 2026, Jeffrey Vo published identifier CVE-2026-111959 on the oss-sec feed, rated moderate severity. The flaw lies in improper validation of RunEndEncoded arrays in the ArrayData interface of Apache Arrow Rust (crate arrow) and can cause an out-of-bounds read. The source lists these affected versions: 60.0.0 before 60.1.0, 59.0.0 through 59.3.1, 58.0.0 through 58.4.0, and 33.0.0 through 57.3.1. The source is an automatic translation and its description is brief and truncated. For teams that maintain systems depending on this library, a useful check is to confirm which Arrow Rust versions are in use across projects and transitive dependencies. Consult the original advisory on the oss-sec list from November 2026 to verify the full text, the fixed versions and the project's recommendations before making any decision.