{"id":"EM-20261102-6XNM","url":"https://cyber.eventmonitor.net/incident/EM-20261102-6XNM/critical-apache-arrow-rust-vulnerability-cve-2026-111959/","type":"cve","title":"Critical Apache Arrow Rust Vulnerability (CVE-2026-111959)","subtitle":"CVE-2026-111959","subject":"CVE-2026-111959","status":"Developing","severity":"critical","affected":[],"headline":null,"born":"2026-11-02T14:17:35.493Z","firstSignal":"2026-11-02T13:34:17.000Z","lastSignal":"2026-11-02T14:17:35.493Z","updated":"2026-11-06T19:22:11.551Z","revision":1,"life":[{"status":"Born","at":"2026-11-02T14:17:35.493Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-02T14:17:35.493Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-02T13:34:17.000Z","what":"First signal: C41 Red Hat Security Data"},{"at":"2026-11-02T14:17:35.493Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261102-6XNM created."},{"at":"2026-11-02T14:17:35.493Z","what":"Severity raised to Critical by C6"}],"stages":[{"name":"Disclosed","at":"2026-11-02T14:17:35.493Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-02T14:17:35.493Z","detail":"CVSS 9.1 · EPSS 0.2%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-02T13:34:17.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-02T13:34:17.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":2,"title":"Red Hat: CVE-2026-111959 (moderate)","text":"arrow: arrow: Out-of-bounds read via improper validation of RunEndEncoded arrays","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-111959.json"},{"at":"2026-11-02T14:17:35.493Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":4,"title":"CVE-2026-111959 (CVSS 9.1)","text":"Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.\n\n\n\nImproper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.\n\n\n\nUsers are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111959"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-02T14:17:35.493","score":9.1,"severity":"CRITICAL","desc":"Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0.\n\n\n\nImproper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.\n\n\n\nUsers…","product":"","seen":1793992931551},"kev":null,"epss":{"epss":0.00232,"pct":0.14177,"at":1793803438877},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}