Apache Arrow (Apache Software Foundation) - vulnerabilities (CVEs)

3 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-02-17. Vendor: Apache Software Foundation.

CVEs of Apache Arrow

• CVE-2026-25087 - CVSS 7 (high), 2026-02-17: Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow…
• CVE-2019-12410 - CVSS 7.5 (high), 2019-11-08: While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data…
• CVE-2019-12408 - CVSS 7.5 (high), 2019-11-08: It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized…