CVE-2026-111959— Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads

Quick assessment

Affected

Apache Software Foundation Apache Arrow Rust

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Arrow Rust（ crate）存在越界读取漏洞，影响版本范围从 33.0.0 至 57.3.1、58.4.0、59.3.1 和 60.0.0。由于接口中对 RunEndEncoded 数组的验证不当，攻击者可能读取超出子值数组边界的数据。建议用户升级至已修复该问题的版本：60.1.0、59.3.2、58.4.1 或 57.3.2。

AI Predicted 5.5 Difficulty: Moderate Updated Nov 02, 2026

Possible ATT&CK Techniques 2 AI

T1068.002 T1212 · Exploitation for Credential Access

Updated Nov 02, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads

Source: CVE Program / CVE List V5

Vulnerability Description

Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array. Users are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Apache Software Foundation	Apache Arrow Rust	60.0.0 ~ 60.1.0	-

II. Public POCs for CVE-2026-111959

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-111959

请登录查看更多情报信息。

Other References for CVE-2026-111959 (1)

https://lists.apache.org/thread.html/hnlrdk4w99b188w1zgjlctpwpg7y55o4 vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-111959

Same Patch Batch · Apache Software Foundation · 2026-11-02 · 6 CVEs total

CVE-2026-114364		Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search
CVE-2026-113687		Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass
CVE-2026-113511		Apache Syncope: Delegated administration boundaries can be bypassed for Realm update
CVE-2026-110535		Apache Syncope: AuthProfile value escalation via self-service update
CVE-2026-109083		Apache Syncope: Remote Code Execution via Flowable JUEL expression

IV. Related Vulnerabilities

Same vendor: Apache Software Foundation

Same weakness: CWE-125