Apache Arrow vulnerabilities

Latest Apache Arrow CVEs

Newest publication first

1. CVE-2026-25087 Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering

   Published 2026-02-17

   High·CVSS 7.0

   Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file (but not an IPC stream) with pre-buffering enabled, if the IPC file contains data with variadic buffers (such as Bi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.