PT-2024-9096 · Apache+1 · Apache Arrow R Package+1
Dewey Dunnington
·
Published
2024-06-13
·
Updated
2025-09-26
·
CVE-2024-52338
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Apache Arrow R package versions 4.0.0 through 16.1.0
Description:
The issue is related to the deserialization of untrusted data in IPC and Parquet readers, which allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather, or Parquet data from untrusted sources, such as user-supplied input files. This vulnerability only affects the Apache Arrow R package, not other Apache Arrow implementations or bindings, unless those bindings are specifically used via the R package.
Recommendations:
To resolve the issue, users of the Apache Arrow R package should upgrade to version 17.0.0 or later. Similarly, downstream libraries should upgrade their dependency requirements to arrow 17.0.0 or later. If using an affected version of the package, untrusted data can be read into a Table, and its internal
to data frame() method can be used as a workaround, for example, read parquet(..., as data frame = FALSE)$to data frame().Fix
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Apache Arrow R Package