Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array. Users are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🔴 Newly rated critical, disclosed Nov 2 Apache Arrow: out-of-bounds reads in run-end (CVE-2026-111959) An attacker can craft run-end encoded arrays that read memory beyond their bounds, exposing data or crashing software. Patch → 60.1.0, 57.3.2 and more https://cve.now/CVE-2026-111959?utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=critical
A fully patched Linux host can still be running vulnerable code. CVE-2026-111959 is a useful reminder that Rust dependencies may be compiled into the application binary. Updating the OS package set does not automatically replace an affected Arrow crate embedded in that application. That creates a vulnerability-management gap: the host can look current while the deployed workload is not. **In practical terms, it is a good time to:** - inspect `Cargo.lock` for `arrow` and `arrow-data` versions - use `cargo tree` to identify transitive Arrow dependencies - map affected builds to the binaries and container images actually deployed - verify the replacement application's build or image digest after rollout How many vulnerability programs can prove what library code is inside the application actually running in production? #LinuxSecurity #VulnerabilityManagement #Rust #SupplyChainSecurity https://linuxsecurity.com/news/security-vulnerabilities/apache-arrow-explained-rust-update