Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2026/VULN190
_____________________________________________________________________

DATE                : 18/02/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Arrow versions prior
                                   to 23.0.1.

=====================================================================
https://lists.apache.org/thread/rtmjkz2mzm35grc1sjfmm1nmt9m6q1fb
_____________________________________________________________________

CVE-2026-25087: Apache Arrow: Potential use-after-free when reading
IPC file with pre-buffering

Severity: moderate

Affected versions:

- Apache Arrow 15.0.0 through 23.0.0
- Apache Arrow 23.0.1 unaffected


Description:

Use After Free vulnerability in Apache Arrow C++.

This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can
be triggered when reading an Arrow IPC file (but not an IPC stream)
with pre-buffering enabled, if the IPC file contains data with
variadic buffers (such as Binary View and String View data). Depending
on the number of variadic buffers in a record batch column and on the
temporal sequence of multi-threaded IO, a write to a dangling pointer
could occur. The value (a `std::shared_ptr<Buffer>` object) that is
written to the dangling pointer is not under direct control of the
attacker.

Pre-buffering is disabled by default but can be enabled using a
specific C++ API call (`RecordBatchFileReader:reBufferMetadata`).
The functionality is not exposed in language bindings
(Python, Ruby, C GLib), so these bindings are not vulnerable.

The most likely consequence of this issue would be random crashes or
memory corruption when reading specific kinds of IPC files. If the
application allows ingesting IPC files from untrusted sources, this
could plausibly be exploited for denial of service. Inducing more
targeted kinds of misbehavior (such as confidential data extraction
from the running process) depends on memory allocation and
multi-threaded IO temporal patterns that are unlikely to be easily
controlled by an attacker.

Advice for users of Arrow C++:

1. check whether you enable pre-buffering on the IPC file reader
(using `RecordBatchFileReader:reBufferMetadata`)

2. if so, either disable pre-buffering (which may have adverse
performance consequences), or switch to Arrow 23.0.1 which is not
vulnerable


Credit:

"emi" / "rootkid19" (reporter)


References:

https://github.com/apache/arrow/pull/48925
https://arrow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-25087



=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================