Skip to main content
VulnerabilityPublished

Arrow: Heap-use-after-free

Affects arrowSource GCVE Database

0
Severity
High

Rated High by Threat Radar's AI analysis

Patch
Available – fixed in 98620f54a742d06e799aca02622cdbc67e4cc916, 83a5a61970a70d5b8fd0913341b3331be141da56

Data as of 13 Nov 2026, 19:14 UTC

What to do

Upgrade arrow to 98620f54a742d06e799aca02622cdbc67e4cc916 or 83a5a61970a70d5b8fd0913341b3331be141da56.

Affected software

ProductAffectedFixed in
OSS-Fuzzarrowpkg:generic/arrowOther threatsAffected
  • >=a0aa749eba97c63e4c8e1c689069d1ac3a70dfe2 <83a5a61970a70d5b8fd0913341b3331be141da56
  • <98620f54a742d06e799aca02622cdbc67e4cc916
Fixed in
  • 83a5a61970a70d5b8fd0913341b3331be141da56
  • 98620f54a742d06e799aca02622cdbc67e4cc916

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A patch is available and has been applied in the specified commits. Users should update to the fixed versions referenced by commit hashes 98620f54a742d06e799aca02622cdbc67e4cc916 and 83a5a61970a70d5b8fd0913341b3331be141da56 to remediate this vulnerability.

Description

A heap-use-after-free vulnerability was identified in Apache Arrow's Thrift deserialization code, specifically within the TCompactProtocolT implementation. The issue was reported by OSS-Fuzz and involves a read operation after memory has been freed, which can lead to undefined behavior or crashes. The vulnerability has been addressed in specific commits.

References

Community reviews

Loading reviews…