CVE-2024-52338 Apache Arrow R package: Arbitrary code execution when loading a malicious data file
Attackers can execute arbitrary code by tricking users into loading malicious Arrow IPC or Parquet files in the Apache Arrow R package.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-52338?
CVE-2024-52338 is a critical unsafe deserialization vulnerability in Apache Arrow R package, published on 28 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example, user-supplied input files). This vulnerability only affects the arrow R package, not other Apache Arrow implementations or bindings unless those bindings are specifically used via the R package (for example, an R application that embeds a Python interpreter and uses PyArrow to read files from untrusted sources is still vulnerable if the arrow R package is an affected version). It is recommended that users of the arrow R package upgrade to 17.0.0 or later. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to arrow 17.0.0 or later. If using an affected version of the package, untrusted data can read into a Table and its internal to_data_frame() method can be used as a workaround (e.g., read_parquet(..., as_data_frame = FALSE)$to_data_frame()).
This issue affects the Apache Arrow R package: from 4.0.0 through 16.1.0.
Users are recommended to upgrade to version 17.0.0, which fixes the issue.
Weakness: CWE-502
Which versions are affected by CVE-2024-52338?
1 open source package ship an affected version, including pyarrow. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pyarrow PyPI | From 4.0.0 | 17.0.0 |
Products include Apache Arrow.
How do I fix CVE-2024-52338?
Upgrade pyarrow to 17.0.0 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2024-52338 being exploited?
There is no known exploitation of CVE-2024-52338 in the wild and no public exploit code.
Other vulnerabilities in Apache Arrow R package
- CVE-2024-41178 Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files
- CVE-2019-12408 Missing Initialization of Resource in Apache Arrow
- CVE-2019-12410 Missing Initialization of Resource in Apache Arrow
- CVE-2026-25087 Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering
Sources
Also known as AZL-53423, AZL-53471, GHSA-m5xw-hwxw-fq3j, JLSEC-2026-804, PYSEC-2024-161.