CYBERSECURITYTRACKER
Permanent story citation

CVE-2026-111959: Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 12116

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2026-111959: Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads

CVE-2026-111959 affects Apache Arrow Rust versions 33.0.0 through 60.0.0 and involves improper validation of RunEndEncoded arrays in the ArrayData interface, enabling out-of-bounds reads. The vulnerability is rated moderate severity and requires patching to versions 60.1.0 or later, or the corresponding patch releases for earlier branches (58.4.1, 59.3.2).

Why it matters: Developers and operators using Apache Arrow Rust in data processing pipelines face potential information disclosure or denial of service if they do not upgrade to patched versions.

CVEsCVE-2026-111959
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary