GHSA-wv8j-m3hx-924j Arrow2 allows out of bounds access in public safe API
Out-of-bounds access in arrow2's public API allows attackers to cause memory corruption or crashes; users must migrate to the maintained arrow crate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-wv8j-m3hx-924j?
GHSA-wv8j-m3hx-924j is a memory corruption vulnerability in arrow2, published on 24 Apr 2025.
Official description
Rows::row_unchecked() allows out of bounds access to the underlying buffer without sufficient checks.
The arrow2 crate is no longer maintained, so there are no plans to fix this issue. Users are advised to migrate to the arrow crate, instead.
Which versions are affected by GHSA-wv8j-m3hx-924j?
3 open source packages ship an affected version, including arrow2.
| Package | Affected | Fixed in |
|---|---|---|
arrow2 crates.io | All versions to 0.18.0 | None |
arrow2 crates.io | All versions to 0.18.0 | None |
arrow2 crates.io | From 0.0.0-0 | None |
How do I fix GHSA-wv8j-m3hx-924j?
No fix has been published for GHSA-wv8j-m3hx-924j yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is GHSA-wv8j-m3hx-924j being exploited?
There is no known exploitation of GHSA-wv8j-m3hx-924j in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2025-0038.