Arrow vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

AR

Product

Arrow

by Apache · last CVE Oct 22, 2026

On CISA KEVExploited in the wild

6

CVEs

1

On KEV

9.8

Max CVSS

1

New 30D

Vulnerabilities6 In the news8 Timeline

Severity mix

Critical 2High 4Medium 0Low 0

Severity

All severities6 Critical2 High4 Medium0 Low0

Exploitation

On CISA KEV1 Exploited in the wild1

Watch

Add Arrow to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2024-41178	7.5	1%	Jul 23	Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files Affected: 0.5.0 through 0.10.1
CVE-2019-12410	7.5	5%	Nov 8	While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when… Affected: 0.12.0 through 0.14.1
CVE-2019-12408	7.5	3%	Nov 8	It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when… Affected: 0.14.0 through 0.14.1
CVE-2026-25087	7.0	1%	Feb 17	Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering Affected: 15.0.0 before 23.0.1