PT-2026-135435

CVE-2026-111959

Published

2026-11-02

Updated

2026-11-02

Score

N/A

Not available

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.

Out-of-bounds read vulnerability in Apache Arrow Rust (arrow crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.

Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.

Users are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

Related identifiers

Found an issue in the description? Have something to add? Feel free to write us 👾