AR
Product
Arrow
On CISA KEVExploited in the wild
6
CVEs
1
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 2High 4Medium 0Low 0
Watch
Add Arrow to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-111497 In wildKEVNew | 9.8 | Oct 22 | Out-of-Bounds Write in Google Brotli Decoder Affected: through 26.0.0; 27.0.0 |
| CVE-2024-52338 | 9.8 | Nov 28 | Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution Affected: 4.0.0 before 17.0.0 |
| CVE-2024-41178 | 7.5 | Jul 23 | Exposure of temporary credentials in logs in Apache Arrow Rust Object Store (`object_store` crate), version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens. On… Affected: 0.5.0 through 0.10.1 |
| CVE-2019-12410 | 7.5 | Nov 8 | While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when… Affected: 0.12.0 through 0.14.1 |
| CVE-2019-12408 | 7.5 | Nov 8 | It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when… Affected: 0.14.0 through 0.14.1 |
| CVE-2026-25087 | 7.0 | Feb 17 | Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering Affected: 15.0.0 before 23.0.1 |
Showing 6