CVE-2026-111959

Out-of-bounds read vulnerability in Apache Arrow Rust arrow crate, from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array. Users are...

EUVD-2026-115182

Out-of-bounds read vulnerability in Apache Arrow Rust arrow crate, from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array. Users are...

WS-2021-0390

An issue was found in all versions of the arrow crate. "DecimalArray" performs insufficient bounds checks, which allows out-of-bounds reads in safe code if the length of the backing buffer is not a multiple of 16...