CVE-2026-25087

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25087", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-01-29T09:18:06.955Z", "datePublished": "2026-02-17T13:18:25.494Z", "dateUpdated": "2026-02-20T09:56:43.018Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache Arrow", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "23.0.0", "status": "affected", "version": "15.0.0", "versionType": "semver"}, {"status": "unaffected", "version": "23.0.1", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Emi Galle"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Use After Free vulnerability in Apache Arrow C++.</p><p>This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file (but not an IPC stream) with pre-buffering enabled, if the IPC file contains data with variadic buffers (such as Binary View and String View data). Depending on the number of variadic buffers in a record batch column and on the temporal sequence of multi-threaded IO, a write to a dangling pointer could occur. The value (a `std::shared_ptr&lt;Buffer&gt;` object)&nbsp;that is written to the dangling pointer is not under direct control of the attacker.</p><p>Pre-buffering is disabled by default but can be enabled using a specific C++ API call (`RecordBatchFileReader::PreBufferMetadata`). The functionality is not exposed in language bindings (Python, Ruby, C GLib), so these bindings are not vulnerable.</p><p>The most likely consequence of this issue would be random crashes or memory corruption when reading specific kinds of IPC files. If the application allows ingesting IPC files from untrusted sources, this could plausibly be exploited for denial of service. Inducing more targeted kinds of misbehavior (such as confidential data extraction from the running process) depends on memory allocation and multi-threaded IO temporal patterns that are unlikely to be easily controlled by an attacker.</p><p>Advice for users of Arrow C++:</p><p>1. check whether you enable pre-buffering on the IPC file reader (using&nbsp;`RecordBatchFileReader::PreBufferMetadata`)</p><p>2. if so, either disable pre-buffering (which may have adverse performance consequences), or switch to Arrow 23.0.1 which is not vulnerable</p><p><br></p>"}], "value": "Use After Free vulnerability in Apache Arrow C++.\n\nThis issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file (but not an IPC stream) with pre-buffering enabled, if the IPC file contains data with variadic buffers (such as Binary View and String View data). Depending on the number of variadic buffers in a record batch column and on the temporal sequence of multi-threaded IO, a write to a dangling pointer could occur. The value (a `std::shared_ptr<Buffer>` object)\u00a0that is written to the dangling pointer is not under direct control of the attacker.\n\nPre-buffering is disabled by default but can be enabled using a specific C++ API call (`RecordBatchFileReader::PreBufferMetadata`). The functionality is not exposed in language bindings (Python, Ruby, C GLib), so these bindings are not vulnerable.\n\nThe most likely consequence of this issue would be random crashes or memory corruption when reading specific kinds of IPC files. If the application allows ingesting IPC files from untrusted sources, this could plausibly be exploited for denial of service. Inducing more targeted kinds of misbehavior (such as confidential data extraction from the running process) depends on memory allocation and multi-threaded IO temporal patterns that are unlikely to be easily controlled by an attacker.\n\nAdvice for users of Arrow C++:\n\n1. check whether you enable pre-buffering on the IPC file reader (using\u00a0`RecordBatchFileReader::PreBufferMetadata`)\n\n2. if so, either disable pre-buffering (which may have adverse performance consequences), or switch to Arrow 23.0.1 which is not vulnerable"}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-416", "description": "CWE-416 Use After Free", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-02-20T09:56:43.018Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/apache/arrow/pull/48925"}, {"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/mpm4ld1qony30tchfpjtk5b11tcyvmwh"}], "source": {"discovery": "INTERNAL"}, "title": "Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-02-17T14:47:20.157749Z", "id": "CVE-2026-25087", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T14:48:48.265Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/02/17/4"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-02-17T18:17:44.990Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/02/17/4"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-02-17T18:17:44.990Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-25087", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-17T14:47:20.157749Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T14:46:09.606Z"}}], "cna": {"title": "Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering", "source": {"discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Emi Galle"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Arrow", "versions": [{"status": "affected", "version": "15.0.0", "versionType": "semver", "lessThanOrEqual": "23.0.0"}, {"status": "unaffected", "version": "23.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/apache/arrow/pull/48925", "tags": ["patch"]}, {"url": "https://lists.apache.org/thread/mpm4ld1qony30tchfpjtk5b11tcyvmwh", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Use After Free vulnerability in Apache Arrow C++.\n\nThis issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file (but not an IPC stream) with pre-buffering enabled, if the IPC file contains data with variadic buffers (such as Binary View and String View data). Depending on the number of variadic buffers in a record batch column and on the temporal sequence of multi-threaded IO, a write to a dangling pointer could occur. The value (a `std::shared_ptr<Buffer>` object)\u00a0that is written to the dangling pointer is not under direct control of the attacker.\n\nPre-buffering is disabled by default but can be enabled using a specific C++ API call (`RecordBatchFileReader::PreBufferMetadata`). The functionality is not exposed in language bindings (Python, Ruby, C GLib), so these bindings are not vulnerable.\n\nThe most likely consequence of this issue would be random crashes or memory corruption when reading specific kinds of IPC files. If the application allows ingesting IPC files from untrusted sources, this could plausibly be exploited for denial of service. Inducing more targeted kinds of misbehavior (such as confidential data extraction from the running process) depends on memory allocation and multi-threaded IO temporal patterns that are unlikely to be easily controlled by an attacker.\n\nAdvice for users of Arrow C++:\n\n1. check whether you enable pre-buffering on the IPC file reader (using\u00a0`RecordBatchFileReader::PreBufferMetadata`)\n\n2. if so, either disable pre-buffering (which may have adverse performance consequences), or switch to Arrow 23.0.1 which is not vulnerable", "supportingMedia": [{"type": "text/html", "value": "<p>Use After Free vulnerability in Apache Arrow C++.</p><p>This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file (but not an IPC stream) with pre-buffering enabled, if the IPC file contains data with variadic buffers (such as Binary View and String View data). Depending on the number of variadic buffers in a record batch column and on the temporal sequence of multi-threaded IO, a write to a dangling pointer could occur. The value (a `std::shared_ptr&lt;Buffer&gt;` object)&nbsp;that is written to the dangling pointer is not under direct control of the attacker.</p><p>Pre-buffering is disabled by default but can be enabled using a specific C++ API call (`RecordBatchFileReader::PreBufferMetadata`). The functionality is not exposed in language bindings (Python, Ruby, C GLib), so these bindings are not vulnerable.</p><p>The most likely consequence of this issue would be random crashes or memory corruption when reading specific kinds of IPC files. If the application allows ingesting IPC files from untrusted sources, this could plausibly be exploited for denial of service. Inducing more targeted kinds of misbehavior (such as confidential data extraction from the running process) depends on memory allocation and multi-threaded IO temporal patterns that are unlikely to be easily controlled by an attacker.</p><p>Advice for users of Arrow C++:</p><p>1. check whether you enable pre-buffering on the IPC file reader (using&nbsp;`RecordBatchFileReader::PreBufferMetadata`)</p><p>2. if so, either disable pre-buffering (which may have adverse performance consequences), or switch to Arrow 23.0.1 which is not vulnerable</p><p><br></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-02-20T09:56:43.018Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25087", "state": "PUBLISHED", "dateUpdated": "2026-02-20T09:56:43.018Z", "dateReserved": "2026-01-29T09:18:06.955Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-02-17T13:18:25.494Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache Arrow", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "23.0.0", "status": "affected", "version": "15.0.0", "versionType": "semver"}, {"status": "unaffected", "version": "23.0.1", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:arrow:*:*:*:*:*:*:*:*", "matchCriteriaId": "E8AF4E4F-FF31-4DB2-A4F6-E74C99DE085B", "versionEndExcluding": "23.0.1", "versionStartIncluding": "15.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Use After Free vulnerability in Apache Arrow C++.\n\nThis issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file (but not an IPC stream) with pre-buffering enabled, if the IPC file contains data with variadic buffers (such as Binary View and String View data). Depending on the number of variadic buffers in a record batch column and on the temporal sequence of multi-threaded IO, a write to a dangling pointer could occur. The value (a `std::shared_ptr<Buffer>` object)\u00a0that is written to the dangling pointer is not under direct control of the attacker.\n\nPre-buffering is disabled by default but can be enabled using a specific C++ API call (`RecordBatchFileReader::PreBufferMetadata`). The functionality is not exposed in language bindings (Python, Ruby, C GLib), so these bindings are not vulnerable.\n\nThe most likely consequence of this issue would be random crashes or memory corruption when reading specific kinds of IPC files. If the application allows ingesting IPC files from untrusted sources, this could plausibly be exploited for denial of service. Inducing more targeted kinds of misbehavior (such as confidential data extraction from the running process) depends on memory allocation and multi-threaded IO temporal patterns that are unlikely to be easily controlled by an attacker.\n\nAdvice for users of Arrow C++:\n\n1. check whether you enable pre-buffering on the IPC file reader (using\u00a0`RecordBatchFileReader::PreBufferMetadata`)\n\n2. if so, either disable pre-buffering (which may have adverse performance consequences), or switch to Arrow 23.0.1 which is not vulnerable"}, {"lang": "es", "value": "Vulnerabilidad Use After Free en Apache Arrow C++.\n\nEste problema afecta a Apache Arrow C++ desde la versi\u00f3n 15.0.0 hasta la 23.0.0. Puede activarse al leer un archivo Arrow IPC (pero no un flujo IPC) con el pre-buffer activado, si el archivo IPC contiene datos con buffers vari\u00e1dicos (como datos Binary View y String View). Dependiendo del n\u00famero de buffers vari\u00e1dicos en una columna de lote de registros y de la secuencia temporal de E/S multihilo, podr\u00eda producirse una escritura en un puntero colgante. El valor (un objeto 'std::shared_ptr') que se escribe en el puntero colgante no est\u00e1 bajo el control directo del atacante.\n\nEl pre-buffer est\u00e1 deshabilitado por defecto pero puede habilitarse usando una llamada a la API de C++ espec\u00edfica ('RecordBatchFileReader::PreBufferMetadata'). La funcionalidad no est\u00e1 expuesta en los enlaces de lenguaje (Python, Ruby, C GLib), por lo que estos enlaces no son vulnerables.\n\nLa consecuencia m\u00e1s probable de este problema ser\u00edan fallos aleatorios o corrupci\u00f3n de memoria al leer tipos espec\u00edficos de archivos IPC. Si la aplicaci\u00f3n permite la ingesta de archivos IPC de fuentes no confiables, esto podr\u00eda ser plausiblemente explotado para denegaci\u00f3n de servicio. Inducir tipos de comportamiento err\u00f3neo m\u00e1s espec\u00edficos (como la extracci\u00f3n de datos confidenciales del proceso en ejecuci\u00f3n) depende de la asignaci\u00f3n de memoria y de los patrones temporales de E/S multihilo que es poco probable que sean f\u00e1cilmente controlados por un atacante.\n\nConsejo para los usuarios de Arrow C++:\n\n1. verifique si habilita el pre-buffer en el lector de archivos IPC (usando 'RecordBatchFileReader::PreBufferMetadata')\n\n2. si es as\u00ed, deshabilite el pre-buffer (lo que puede tener consecuencias adversas en el rendimiento), o cambie a Arrow 23.0.1 que no es vulnerable"}], "id": "CVE-2026-25087", "lastModified": "2026-06-17T10:24:05.973", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25087", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-17T14:47:20.157749Z", "version": "2.0.3"}}]}, "published": "2026-02-17T14:16:01.947", "references": [{"source": "security@apache.org", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/apache/arrow/pull/48925"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/mpm4ld1qony30tchfpjtk5b11tcyvmwh"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/02/17/4"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "apache-arrow: Apache Arrow C++: Denial of Service via Use After Free vulnerability when reading IPC files", "id": "2440366", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440366"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["No description is available for this CVE."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-25087", "package_state": [{"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-feature-server-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-02-17T13:18:25Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-25087\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-25087\nhttps://github.com/apache/arrow/pull/48925\nhttps://lists.apache.org/thread/mpm4ld1qony30tchfpjtk5b11tcyvmwh"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[15.0.0,23.0.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "23.0.1"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Arrow", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "arrow", "vendor": "apache"}], "analysis": {"en": {"generated_at": "2026-04-17T18:57:04.134212+00:00", "value": {"mitigation_remediation": ["Upgrade Apache Arrow to version\u00a023.0.1 or later to eliminate the use\u2011after\u2011free flaw", "If the upgrade cannot be performed immediately, disable pre\u2011buffering by avoiding a call to RecordBatchFileReader::PreBufferMetadata", "Restrict ingestion of IPC files to trusted sources and validate file integrity before processing"], "summary": {"action": "Patch Upgrade", "impact": "Denial of Service via use\u2011after\u2011free"}, "threat_synthesis": {"affected_systems": "Apache Arrow C++ library versions 15.0.0 through 23.0.0 are affected when the C++ API RecordBatchFileReader::PreBufferMetadata is used to enable pre\u2011buffering. Language bindings such as Python, Ruby, and C GLib do not expose the vulnerable API and are therefore not vulnerable. Any application that incorporates these C++ versions and ingests IPC files from untrusted sources could be impacted.", "description_and_impact": "A use\u2011after\u2011free flaw exists in Apache Arrow C++ when reading IPC files that contain variadic buffers and the reader\u2019s pre\u2011buffering feature is enabled. The vulnerability can cause a write to a dangling pointer, resulting in memory corruption or random crashes. Although the value written is not directly attacker controlled, the effect can lead to denial of service or, in rare assembly patterns, potential confidentiality leakage in a running process. The weakness corresponds to CWE\u2011416 and CWE\u2011825.", "risk_and_exploitability": "The CVSS score is 7, indicating high severity, but the EPSS score of less than 1\u00a0% suggests that exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. The attack route requires an attacker to supply a specially crafted IPC file to an application that has enabled pre\u2011buffering via the C++ API; this is typically an internal or local threat. The most probable consequence is application crashes or service disruption, with remote code execution being improbable unless additional memory corruption conditions are met."}}}}, "created": "2026-02-18T10:43:56.407763+00:00", "updated": "2026-04-17T19:00:11.056862+00:00", "vendors": ["apache", "apache$PRODUCT$arrow"]}