Missing initialization of resource in Apache Arrow
Priority MEDIUM 40CWE-909Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory could potentially be shared if are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.
Why it matters now
EPSS 0.04608 91st percentileScored 2026-11-07
Fix Fixed pyarrow (PyPI): 0.15.1red-arrow (RubyGems): 0.15.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Arrow | Apache Arrow 0.12.0 to 0.14.1 | — | No fix listed | CNA |
| — | pyarrow (PyPI) | 0.12.0 to before 0.15.1 | 0.15.1 | Patch available | GHSA-cjw4-2w9r-r8mv |
| — | red-arrow (RubyGems) | 0.12.0 to before 0.15.1 | 0.15.1 | Patch available | GHSA-cjw4-2w9r-r8mv |
- Apache Arrow VendorApache Affected Apache Arrow 0.12.0 to 0.14.1 Fixed in — No fix listed CNA
- pyarrow (PyPI) Vendor— Affected 0.12.0 to before 0.15.1 Fixed in 0.15.1 Patch available GHSA-cjw4-2w9r-r8mv
- red-arrow (RubyGems) Vendor— Affected 0.12.0 to before 0.15.1 Fixed in 0.15.1 Patch available GHSA-cjw4-2w9r-r8mv
Remediation
- Fix · GHSA-cjw4-2w9r-r8mv pyarrow (PyPI) Fixed in 0.15.1 Advisory →
- Fix · GHSA-cjw4-2w9r-r8mv red-arrow (RubyGems) Fixed in 0.15.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-12410
- 2026-10-03 Alias added: GHSA-cjw4-2w9r-r8mv
References
Advisory 3
Other 7
- [arrow-dev] 20191108 [CVE-2019-12408][CVE-2019-12410] Uninitialized Memory Vulnerabilities fixed in Apache Arrow 0.15.1
- [announce] 20191108 [CVE-2019-12408][CVE-2019-12410] Uninitialized Memory Vulnerabilities fixed in Apache Arrow 0.15.1
- https://github.com/apache/arrow
- https://github.com/pypa/advisory-database/tree/main/vulns/pyarrow/PYSEC-2019-196.yaml
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/red-arrow/CVE-2019-12410.yml
- https://lists.apache.org/thread.html/49f067b1c5fb7493d952580f0d2d032819ba351f7a78743c21126269@%3Cdev.arrow.apache.org%3E
- https://lists.apache.org/thread.html/efd8bbf57427d3c303b5316d208a335f8d0c0dbe0dc4c87cfa995073@%3Cannounce.apache.org%3E
More Apache Arrow vulnerabilities
- TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
- TI-2024-35010 Apache Arrow R package: Arbitrary code execution when loading a malicious data file CVSS 3.1CRITICAL 9.8
- TI-2024-27524 Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files CVSS 3.1HIGH 7.5
- TI-2019-09254 Missing initialization of resource in Apache Arrow CVSS 3.1HIGH 7.5
- TI-2026-20262 Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering CVSS 3.1HIGH 7.0
Sources
- CVE-2019-12410 · CVE Program
- CVE-2019-12410 · NVD
- FIRST EPSS
- GHSA-cjw4-2w9r-r8mv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences