Read the docs
TI-2023-25566 Aliases CVE-2023-47248GHSA-5wvp-7f3h-6wmm

PyArrow, PyArrow: Arbitrary code execution when loading a malicious data file

Priority MEDIUM 57CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files). This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings. It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon. If it is not possible to upgrade, we provide a separate package `pyarrow-hotfix` that disables the vulnerability on older PyArrow versions. See https://pypi.org/project/pyarrow-hotfix/ for instructions.

Why it matters now

EPSS 0.14528 96th percentileScored 2026-11-07
Fix Fixed pyarrow (PyPI): 14.0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApachePyArrow0.14.0 – 14.0.0—No fix listedCNA
ApachePyArrow0.14.0 – 14.0.0—No fix listedCNA
—pyarrow (PyPI)0.14.0 to before 14.0.114.0.1Patch availableGHSA-5wvp-7f3h-6wmm
  • PyArrow VendorApache Affected 0.14.0 – 14.0.0 Fixed in — No fix listed CNA
  • PyArrow VendorApache Affected 0.14.0 – 14.0.0 Fixed in — No fix listed CNA
  • pyarrow (PyPI) Vendor— Affected 0.14.0 to before 14.0.1 Fixed in 14.0.1 Patch available GHSA-5wvp-7f3h-6wmm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:pyarrow:*:*:*:*:*:*:*:*0.14.0 – 14.0.0VulnerableApache
  • cpe:2.3:a:apache:pyarrow:*:*:*:*:*:*:*:* Versions 0.14.0 – 14.0.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-5wvp-7f3h-6wmm pyarrow (PyPI) Fixed in 14.0.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-47248
  2. 2026-10-03 Alias added: GHSA-5wvp-7f3h-6wmm

References

Patch 1

Advisory 3

Other 12

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences