CVE-2026-25087

{"id": "CVE-2026-25087", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 2.2}]}, "published": "2026-02-17T14:16:01.947", "references": [{"url": "https://github.com/apache/arrow/pull/48925", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/mpm4ld1qony30tchfpjtk5b11tcyvmwh", "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/02/17/4", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "Use After Free vulnerability in Apache Arrow C++.\n\nThis issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file (but not an IPC stream) with pre-buffering enabled, if the IPC file contains data with variadic buffers (such as Binary View and String View data). Depending on the number of variadic buffers in a record batch column and on the temporal sequence of multi-threaded IO, a write to a dangling pointer could occur. The value (a `std::shared_ptr<Buffer>` object)\u00a0that is written to the dangling pointer is not under direct control of the attacker.\n\nPre-buffering is disabled by default but can be enabled using a specific C++ API call (`RecordBatchFileReader::PreBufferMetadata`). The functionality is not exposed in language bindings (Python, Ruby, C GLib), so these bindings are not vulnerable.\n\nThe most likely consequence of this issue would be random crashes or memory corruption when reading specific kinds of IPC files. If the application allows ingesting IPC files from untrusted sources, this could plausibly be exploited for denial of service. Inducing more targeted kinds of misbehavior (such as confidential data extraction from the running process) depends on memory allocation and multi-threaded IO temporal patterns that are unlikely to be easily controlled by an attacker.\n\nAdvice for users of Arrow C++:\n\n1. check whether you enable pre-buffering on the IPC file reader (using\u00a0`RecordBatchFileReader::PreBufferMetadata`)\n\n2. if so, either disable pre-buffering (which may have adverse performance consequences), or switch to Arrow 23.0.1 which is not vulnerable"}, {"lang": "es", "value": "Vulnerabilidad Use After Free en Apache Arrow C++.\n\nEste problema afecta a Apache Arrow C++ desde la versi\u00f3n 15.0.0 hasta la 23.0.0. Puede activarse al leer un archivo Arrow IPC (pero no un flujo IPC) con el pre-buffer activado, si el archivo IPC contiene datos con buffers vari\u00e1dicos (como datos Binary View y String View). Dependiendo del n\u00famero de buffers vari\u00e1dicos en una columna de lote de registros y de la secuencia temporal de E/S multihilo, podr\u00eda producirse una escritura en un puntero colgante. El valor (un objeto 'std::shared_ptr') que se escribe en el puntero colgante no est\u00e1 bajo el control directo del atacante.\n\nEl pre-buffer est\u00e1 deshabilitado por defecto pero puede habilitarse usando una llamada a la API de C++ espec\u00edfica ('RecordBatchFileReader::PreBufferMetadata'). La funcionalidad no est\u00e1 expuesta en los enlaces de lenguaje (Python, Ruby, C GLib), por lo que estos enlaces no son vulnerables.\n\nLa consecuencia m\u00e1s probable de este problema ser\u00edan fallos aleatorios o corrupci\u00f3n de memoria al leer tipos espec\u00edficos de archivos IPC. Si la aplicaci\u00f3n permite la ingesta de archivos IPC de fuentes no confiables, esto podr\u00eda ser plausiblemente explotado para denegaci\u00f3n de servicio. Inducir tipos de comportamiento err\u00f3neo m\u00e1s espec\u00edficos (como la extracci\u00f3n de datos confidenciales del proceso en ejecuci\u00f3n) depende de la asignaci\u00f3n de memoria y de los patrones temporales de E/S multihilo que es poco probable que sean f\u00e1cilmente controlados por un atacante.\n\nConsejo para los usuarios de Arrow C++:\n\n1. verifique si habilita el pre-buffer en el lector de archivos IPC (usando 'RecordBatchFileReader::PreBufferMetadata')\n\n2. si es as\u00ed, deshabilite el pre-buffer (lo que puede tener consecuencias adversas en el rendimiento), o cambie a Arrow 23.0.1 que no es vulnerable"}], "lastModified": "2026-02-18T17:52:22.253", "sourceIdentifier": "security@apache.org"}