A heap-use-after-free vulnerability was identified in Apache Arrow's Thrift deserialization code, specifically within the TCompactProtocolT implementation. The issue was reported by OSS-Fuzz and involves a read operation after memory has been freed, which can lead to undefined behavior or crashes. The vulnerability has been addressed in specific commits.