High severity · published Nov 8, 2019
CVE-2019-12410
While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when…
7.5
CVSS
4.6%
EPSS
No
On KEV
Description
While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory could potentially be shared if are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.6% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
Arrow · Apache
0.12.0 through 0.14.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-12410
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-12410
Mailing List
http://www.openwall.com/lists/oss-security/2019/11/08/1
lists.apache.org
https://lists.apache.org/thread.html/49f067b1c5fb7493d952580f0d2d032819ba351f7a78743c21126269%40%3Cdev.arrow.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/efd8bbf57427d3c303b5316d208a335f8d0c0dbe0dc4c87cfa995073%40%3Cannounce.apache.org%3E
More from Arrow
9.8
CVE-2026-111497
Out-of-Bounds Write in Google Brotli Decoder
9.8
CVE-2024-52338
Apache Arrow R package: Arbitrary code execution when loading a malicious data file
7.5
CVE-2024-41178
Exposure of temporary credentials in logs in Apache Arrow Rust Object Store (`object_store` crate), version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens. On…
7.5
CVE-2019-12408
It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when…
7.0
CVE-2026-25087
Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering