Apache Arrow Rust Fixes RunEndEncoded Array Out-of-Bounds Reads
Tech GuruQuick Answer
Improper validation of RunEndEncoded arrays through ArrayData can read beyond the child values array. Validate the issue-specific scope and deploy Arrow Rust 60.1.0, 59.3.2, 58.4.1 or 57.3.2.
Confirm Scope And Apply The Supported Remediation
What to do now: Record arrow crate versions, Cargo lockfiles, deployed binaries and paths constructing or receiving RunEndEncoded arrays. Match the documented versions, enabled features and attack prerequisites to the deployment before assigning applicability. Upgrade to an applicable fixed branch and rebuild and redeploy binaries that embed the crate. Confirm deployed dependency versions and test array validation and data pipelines; retain build, lockfile and regression evidence.
Last verified: 2026-11-02 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Apache Arrow Rust |
|---|---|
| Advisory | CVE-2026-111959 |
| CVE | CVE-2026-111959 |
| Authoritative release date | 2026-11-02 11:06:44 UTC |
| Authority revision date | No later revision is stated in the captured announcements. |
| Affected versions | Arrow Rust 33.0.0 through 57.3.1; 58.0.0 through 58.4.0; 59.0.0 through 59.3.1; and 60.0.0 before 60.1.0. |
| Fixed version | Arrow Rust 60.1.0, 59.3.2, 58.4.1 or 57.3.2 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Moderate (Apache rating; CVSS severity not provided) |
| Exploitation status | The cited authority does not state that this issue is being maliciously exploited.; no exploitation claim is inferred. |
Authority-Specific Scope And Version Evidence
| CVE-2026-111959 | - Apache Arrow Rust 60.0.0 before 60.1.0 - Apache Arrow Rust 59.0.0 through 59.3.1 - Apache Arrow Rust 58.0.0 through 58.4.0 - Apache Arrow Rust 33.0.0 through 57.3.1; released 2026-11-02T11:06:44Z. Authority severity: moderate. |
|---|
What Changed
Improper validation of RunEndEncoded arrays through ArrayData can read beyond the child values array.
What To Validate Now
- Inventory. Record arrow crate versions, Cargo lockfiles, deployed binaries and paths constructing or receiving RunEndEncoded arrays.
- Establish applicability. Match the documented versions, enabled features and attack prerequisites to the deployment before assigning applicability.
- Remediate. Upgrade to an applicable fixed branch and rebuild and redeploy binaries that embed the crate.
- Validate. Confirm deployed dependency versions and test array validation and data pipelines; retain build, lockfile and regression evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Updating a lockfile alone does not replace deployed binaries. Apache rates the issue moderate and does not supply a CVSS score.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
