Vulnerability RUSTSEC-2026-0442
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
4 days ago
November 02, 2026 at 12:00 PM UTC
Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads
>=33.0.0 <57.3.2, >=58.0.0 <58.4.1, >=59.0.0 <59.3.2, >=60.0.0 <60.1.0
>=33.0.0 <57.3.2, >=58.0.0 <58.4.1, >=59.0.0 <59.3.2, >=60.0.0 <60.1.0
Summary
Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads
Details
Improper validation of RunEndEncoded arrays via ArrayData::validate_values can allow reading data beyond the bounds of the child values array when reading the last value via APIs such as TypedRunArray::value.
Patched versions now properly validate the contents of RunEndEncoded arrays to prevent allowing reading out of bounds of the specified array data.
Credit to Adam Korczynski of Ada Logics for reporting this and Anthropic for finding this.
Impacted packages
Timeline
Published
4 days ago
November 02, 2026 at 12:00 PM UTC
Fixed (59.3.2)
11 days ago
October 26, 2026 at 09:25 AM UTC
Fixed (58.4.1)
11 days ago
October 26, 2026 at 09:39 AM UTC
Fixed (57.3.2)
11 days ago
October 26, 2026 at 09:51 AM UTC
Fixed (60.1.0)
9 days ago
October 28, 2026 at 08:48 AM UTC
Last Modified
1 day ago
November 05, 2026 at 09:00 AM UTC