Apache Arrow vulnerabilities

5 CVEs affecting Apache Arrow, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-25087, published 2026-02-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-12410, published 2019-11-08. High severity, CVSS 7.5. EPSS: 4.6% chance of exploitation in the next 30 days. While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data…
CVE-2019-12408, published 2019-11-08. High severity, CVSS 7.5. EPSS: 3.3% chance of exploitation in the next 30 days. It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when building arrays with null…
CVE-2024-52338, published 2024-11-28. Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days. Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it reads…
CVE-2026-25087, published 2026-02-17. High severity, CVSS 7.0. EPSS: 0.9% chance of exploitation in the next 30 days. Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file (but not an IPC stream) with…
CVE-2024-41178, published 2024-07-23. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Exposure of temporary credentials in logs in Apache Arrow Rust Object Store (`object_store` crate), version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens. On certain error…