Apache Arrow C++ versions 15.0.0 through 23.0.0 contain a use-after-free vulnerability triggered when reading IPC files with pre-buffering enabled and variadic buffers present. This can cause random crashes or memory corruption. The vulnerability is not present in language bindings like Python or Ruby. Pre-buffering is disabled by default and can be disabled to mitigate risk. A fix is available in version 23.0.1.