https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 18:19:14 +0000 https://cve.radiocsirt.org/vuln/brew-dvc-cve-2026-25087 <p><strong>Affected:</strong> Homebrew: dvc</p> <p>Use After Free vulnerability in Apache Arrow C++.</p> <p>This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file (but not an IPC stream) with pre-buffering enabled, if the IPC file contains data with variadic buffers (such as Binary View and String View data). Depending on the number of variadic buffers in a record batch column and on the temporal sequence of multi-threaded IO, a write to a dangling pointer could occur. The value (a `std::shared_ptr&lt;Buffer&gt;` object) that is written to the dangling pointer is not under direct control of the attacker.</p> <p>Pre-buffering is disabled by default but can be enabled using a specific C++ API call (`RecordBatchFileReader::PreBufferMetadata`). The functionality is not exposed in language bindings (Python, Ruby, C GLib), so these bindings are not vulnerable.</p> <p>The most likely consequence of this issue would be random crashes or memory corruption when reading specific kinds of IPC files. If the application allows ingesting IPC files from untrusted sources, this could plausibly be exploited for denial of service. Inducing more targeted kinds of misbehavior (such as confidential data extraction from the running process) depends on memory allocation and multi-threaded IO temporal patterns that are unlikely to be easily controlled by an attacker.</p> <p>Advice for users of Arrow C++:</p> <p>1. check whether you enable pre-buffering on the IPC file reader (using `RecordBatchFileReader::PreBufferMetadata`)…</p> <p><strong>Affected:</strong> Homebrew: dvc</p> <p>Use After Free vulnerability in Apache Arrow C++.</p> <p>This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file (but not an IPC stream) with pre-buffering enabled, if the IPC file contains data with variadic buffers (such as Binary View and String View data). Depending on the number of variadic buffers in a record batch column and on the temporal sequence of multi-threaded IO, a write to a dangling pointer could occur. The value (a `std::shared_ptr&lt;Buffer&gt;` object) that is written to the dangling pointer is not under direct control of the attacker.</p> <p>Pre-buffering is disabled by default but can be enabled using a specific C++ API call (`RecordBatchFileReader::PreBufferMetadata`). The functionality is not exposed in language bindings (Python, Ruby, C GLib), so these bindings are not vulnerable.</p> <p>The most likely consequence of this issue would be random crashes or memory corruption when reading specific kinds of IPC files. If the application allows ingesting IPC files from untrusted sources, this could plausibly be exploited for denial of service. Inducing more targeted kinds of misbehavior (such as confidential data extraction from the running process) depends on memory allocation and multi-threaded IO temporal patterns that are unlikely to be easily controlled by an attacker.</p> <p>Advice for users of Arrow C++:</p> <p>1. check whether you enable pre-buffering on the IPC file reader (using `RecordBatchFileReader::PreBufferMetadata`)…</p> https://cve.radiocsirt.org/vuln/brew-dvc-cve-2026-25087 https://cve.radiocsirt.org/vuln/euvd-2026-268909 EUVD-2026-268909 https://cve.radiocsirt.org/vuln/euvd-2026-268909 https://cve.radiocsirt.org/vuln/fkie_cve-2026-25087 <p>Use After Free vulnerability in Apache Arrow C++.</p> <p>This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file (but not an IPC stream) with pre-buffering enabled, if the IPC file contains data with variadic buffers (such as Binary View and String View data). Depending on the number of variadic buffers in a record batch column and on the temporal sequence of multi-threaded IO, a write to a dangling pointer could occur. The value (a `std::shared_ptr&lt;Buffer&gt;` object) that is written to the dangling pointer is not under direct control of the attacker.</p> <p>Pre-buffering is disabled by default but can be enabled using a specific C++ API call (`RecordBatchFileReader::PreBufferMetadata`). The functionality is not exposed in language bindings (Python, Ruby, C GLib), so these bindings are not vulnerable.</p> <p>The most likely consequence of this issue would be random crashes or memory corruption when reading specific kinds of IPC files. If the application allows ingesting IPC files from untrusted sources, this could plausibly be exploited for denial of service. Inducing more targeted kinds of misbehavior (such as confidential data extraction from the running process) depends on memory allocation and multi-threaded IO temporal patterns that are unlikely to be easily controlled by an attacker.</p> <p>Advice for users of Arrow C++:</p> <p>1. check whether you enable pre-buffering on the IPC file reader (using `RecordBatchFileReader::PreBufferMetadata`)…</p> <p>Use After Free vulnerability in Apache Arrow C++.</p> <p>This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file (but not an IPC stream) with pre-buffering enabled, if the IPC file contains data with variadic buffers (such as Binary View and String View data). Depending on the number of variadic buffers in a record batch column and on the temporal sequence of multi-threaded IO, a write to a dangling pointer could occur. The value (a `std::shared_ptr&lt;Buffer&gt;` object) that is written to the dangling pointer is not under direct control of the attacker.</p> <p>Pre-buffering is disabled by default but can be enabled using a specific C++ API call (`RecordBatchFileReader::PreBufferMetadata`). The functionality is not exposed in language bindings (Python, Ruby, C GLib), so these bindings are not vulnerable.</p> <p>The most likely consequence of this issue would be random crashes or memory corruption when reading specific kinds of IPC files. If the application allows ingesting IPC files from untrusted sources, this could plausibly be exploited for denial of service. Inducing more targeted kinds of misbehavior (such as confidential data extraction from the running process) depends on memory allocation and multi-threaded IO temporal patterns that are unlikely to be easily controlled by an attacker.</p> <p>Advice for users of Arrow C++:</p> <p>1. check whether you enable pre-buffering on the IPC file reader (using `RecordBatchFileReader::PreBufferMetadata`)…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-25087 https://cve.radiocsirt.org/vuln/ghsa-rgxp-2hwp-jwgg <p><strong>Affected:</strong> PyPI: pyarrow</p> <p>Use After Free vulnerability in Apache Arrow C++.</p> <p>This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file (but not an IPC stream) with pre-buffering enabled, if the IPC file contains data with variadic buffers (such as Binary View and String View data). Depending on the number of variadic buffers in a record batch column and on the temporal sequence of multi-threaded IO, a write to a dangling pointer could occur. The value (a `std::shared_ptr&lt;Buffer&gt;` object) that is written to the dangling pointer is not under direct control of the attacker.</p> <p>Pre-buffering is disabled by default but can be enabled using a specific C++ API call (`RecordBatchFileReader::PreBufferMetadata`). The functionality is not exposed in language bindings (Python, Ruby, C GLib), so these bindings are not vulnerable.</p> <p>The most likely consequence of this issue would be random crashes or memory corruption when reading specific kinds of IPC files. If the application allows ingesting IPC files from untrusted sources, this could plausibly be exploited for denial of service. Inducing more targeted kinds of misbehavior (such as confidential data extraction from the running process) depends on memory allocation and multi-threaded IO temporal patterns that are unlikely to be easily controlled by an attacker.</p> <p>Advice for users of Arrow C++:</p> <p>1. check whether you enable pre-buffering on the IPC file reader (using `RecordBatchFileReader::PreBufferMetadata`)…</p> <p><strong>Affected:</strong> PyPI: pyarrow</p> <p>Use After Free vulnerability in Apache Arrow C++.</p> <p>This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file (but not an IPC stream) with pre-buffering enabled, if the IPC file contains data with variadic buffers (such as Binary View and String View data). Depending on the number of variadic buffers in a record batch column and on the temporal sequence of multi-threaded IO, a write to a dangling pointer could occur. The value (a `std::shared_ptr&lt;Buffer&gt;` object) that is written to the dangling pointer is not under direct control of the attacker.</p> <p>Pre-buffering is disabled by default but can be enabled using a specific C++ API call (`RecordBatchFileReader::PreBufferMetadata`). The functionality is not exposed in language bindings (Python, Ruby, C GLib), so these bindings are not vulnerable.</p> <p>The most likely consequence of this issue would be random crashes or memory corruption when reading specific kinds of IPC files. If the application allows ingesting IPC files from untrusted sources, this could plausibly be exploited for denial of service. Inducing more targeted kinds of misbehavior (such as confidential data extraction from the running process) depends on memory allocation and multi-threaded IO temporal patterns that are unlikely to be easily controlled by an attacker.</p> <p>Advice for users of Arrow C++:</p> <p>1. check whether you enable pre-buffering on the IPC file reader (using `RecordBatchFileReader::PreBufferMetadata`)…</p> https://cve.radiocsirt.org/vuln/ghsa-rgxp-2hwp-jwgg https://cve.radiocsirt.org/vuln/pysec-2026-113 <p><strong>Affected:</strong> PyPI: pyarrow</p> <p>Use After Free vulnerability in Apache Arrow C++.</p> <p>This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file (but not an IPC stream) with pre-buffering enabled, if the IPC file contains data with variadic buffers (such as Binary View and String View data). Depending on the number of variadic buffers in a record batch column and on the temporal sequence of multi-threaded IO, a write to a dangling pointer could occur. The value (a `std::shared_ptr&lt;Buffer&gt;` object) that is written to the dangling pointer is not under direct control of the attacker.</p> <p>Pre-buffering is disabled by default but can be enabled using a specific C++ API call (`RecordBatchFileReader::PreBufferMetadata`). The functionality is not exposed in language bindings (Python, Ruby, C GLib), so these bindings are not vulnerable.</p> <p>The most likely consequence of this issue would be random crashes or memory corruption when reading specific kinds of IPC files. If the application allows ingesting IPC files from untrusted sources, this could plausibly be exploited for denial of service. Inducing more targeted kinds of misbehavior (such as confidential data extraction from the running process) depends on memory allocation and multi-threaded IO temporal patterns that are unlikely to be easily controlled by an attacker.</p> <p>Advice for users of Arrow C++:</p> <p>1. check whether you enable pre-buffering on the IPC file reader (using `RecordBatchFileReader::PreBufferMetadata`)…</p> <p><strong>Affected:</strong> PyPI: pyarrow</p> <p>Use After Free vulnerability in Apache Arrow C++.</p> <p>This issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file (but not an IPC stream) with pre-buffering enabled, if the IPC file contains data with variadic buffers (such as Binary View and String View data). Depending on the number of variadic buffers in a record batch column and on the temporal sequence of multi-threaded IO, a write to a dangling pointer could occur. The value (a `std::shared_ptr&lt;Buffer&gt;` object) that is written to the dangling pointer is not under direct control of the attacker.</p> <p>Pre-buffering is disabled by default but can be enabled using a specific C++ API call (`RecordBatchFileReader::PreBufferMetadata`). The functionality is not exposed in language bindings (Python, Ruby, C GLib), so these bindings are not vulnerable.</p> <p>The most likely consequence of this issue would be random crashes or memory corruption when reading specific kinds of IPC files. If the application allows ingesting IPC files from untrusted sources, this could plausibly be exploited for denial of service. Inducing more targeted kinds of misbehavior (such as confidential data extraction from the running process) depends on memory allocation and multi-threaded IO temporal patterns that are unlikely to be easily controlled by an attacker.</p> <p>Advice for users of Arrow C++:</p> <p>1. check whether you enable pre-buffering on the IPC file reader (using `RecordBatchFileReader::PreBufferMetadata`)…</p> https://cve.radiocsirt.org/vuln/pysec-2026-113 https://cve.radiocsirt.org/vuln/rhsa-2026:61628 <p>runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion urllib3: urllib3 Streaming API improperly handles highly compressed data aiohttp: AIOHTTP&#39;s HTTP Parser auto_decompress feature is vulnerable to zip bomb sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking apache-arrow: Apache Arrow C++: Denial of Service via Use After Free vulnerability when reading IPC files python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing Pillow: python-pillow: Pillow: Arbitrary code execution via malicious PSD file processing thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files python-pillow: Pillow: Denial of Service via crafted BDF font file python-pillow: Pillow: Denial of Service via crafted GD 2.x image file thrift: github.co…</p> <p>runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion urllib3: urllib3 Streaming API improperly handles highly compressed data aiohttp: AIOHTTP&#39;s HTTP Parser auto_decompress feature is vulnerable to zip bomb sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking apache-arrow: Apache Arrow C++: Denial of Service via Use After Free vulnerability when reading IPC files python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing Pillow: python-pillow: Pillow: Arbitrary code execution via malicious PSD file processing thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files python-pillow: Pillow: Denial of Service via crafted BDF font file python-pillow: Pillow: Denial of Service via crafted GD 2.x image file thrift: github.co…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:61628