Detections
Analytics

SCA: security update for pyarrow (GHSA-rgxp-2hwp-jwgg)

high Tenable Cloud Security Plugin ID 442730

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Use After Free vulnerability in Apache Arrow C++. This issue affects Apache Arrow C++ from 15.0.0 through
 23.0.0. It can be triggered when reading an Arrow IPC file (but not an IPC stream) with pre-buffering
 enabled, if the IPC file contains data with variadic buffers (such as Binary View and String View data).
 Depending on the number of variadic buffers in a record batch column and on the temporal sequence of
 multi-threaded IO, a write to a dangling pointer could occur. The value (a `std::shared_ptr<Buffer>`
 object) that is written to the dangling pointer is not under direct control of the attacker. Pre-buffering
 is disabled by default but can be enabled using a specific C++ API call
 (`RecordBatchFileReader::PreBufferMetadata`). The functionality is not exposed in language bindings
 (Python, Ruby, C GLib), so these bindings are not vulnerable. The most likely consequence of this issue
 would be random crashes or memory corruption when reading specific kinds of IPC files. If the application
 allows ingesting IPC files from untrusted sources, this could plausibly be exploited for denial of
 service. Inducing more targeted kinds of misbehavior (such as confidential data extraction from the
 running process) depends on memory allocation and multi-threaded IO temporal patterns that are unlikely to
 be easily controlled by an attacker. Advice for users of Arrow C++: 1. check whether you enable pre-
 buffering on the IPC file reader (using `RecordBatchFileReader::PreBufferMetadata`) 2. if so, either
 disable pre-buffering (which may have adverse performance consequences), or switch to Arrow 23.0.1 which
 is not vulnerable (CVE-2026-25087)

Solution

Update the pyarrow library and its related packages to version 23.0.1 or later.

See Also

https://github.com/advisories/GHSA-rgxp-2hwp-jwgg

Plugin Details

Severity: High

ID: 442730

Version: Revision 1.2

Type: Local

Family: SCA Checks

Published: 6/6/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.9

Percentile: 52.77

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.6

Temporal Score: 4.9

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:C

CVSS Score Source: CVE-2026-25087

CVSS v3

Risk Factor: High

Base Score: 7

Temporal Score: 6.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 2/17/2026

Vulnerability Publication Date: 2/17/2026

Reference Information

CVE: CVE-2026-25087

cwe: CWE-416