Reported

November 2, 2026

Issued

November 5, 2026

Package

arrow-data (crates.io)

Type

INFO Unsound

Categories

• memory-exposure

Keywords

#out-of-bounds-read #validation

Aliases

• CVE-2026-111959
• GHSA-gqmm-qrjq-4c7h

References

• https://github.com/apache/arrow-rs/issues/11587
• https://www.openwall.com/lists/oss-security/2026/11/02/2

Patched

• >=60.1.0
• >=59.3.2, <60.0.0
• >=58.4.1, <59.0.0
• >=57.3.2, <58.0.0

Unaffected

• <33.0.0

Description

Improper validation of RunEndEncoded arrays via ArrayData::validate_values can allow reading data beyond the bounds of the child values array when reading the last value via APIs such as TypedRunArray::value.

Patched versions now properly validate the contents of RunEndEncoded arrays to prevent allowing reading out of bounds of the specified array data.

Credit to Adam Korczynski of Ada Logics for reporting this and Anthropic for finding this.

Advisory available under CC0-1.0 license.