What is CVE-2019-12410?

CVE-2019-12410 is a high-severity vulnerability in Apache Arrow, classified under CWE-909. CVSS score: 7.5/10. Published 2019-11-08.

How severe is CVE-2019-12410?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Apache Arrow

CVE-2019-12410

While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory could potentially be shared if are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.

Published 2019-11-08 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.046 (91.4th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 91st percentile — 91.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.046 · newest: 0.046 · change: 0.000

Affected products

Apache Arrow
Apache Software Foundation Arrow — versions Apache Arrow 0.12.0 to 0.14.1

Weakness classification (CWE)

CWE-909

References

lists.apache.org/thread.html/49f067b1c5fb7493d952580f0d2d032819ba351f7a78743c21… (mailing-list)
www.openwall.com/lists/oss-security/2019/11/08/1 (mailing-list, Mailing List, Third Party Advisory)
lists.apache.org/thread.html/efd8bbf57427d3c303b5316d208a335f8d0c0dbe0dc4c87cfa… (mailing-list)

Frequently asked questions

What is CVE-2019-12410?: CVE-2019-12410 is a high-severity vulnerability in Apache Arrow, classified under CWE-909. CVSS score: 7.5/10. Published 2019-11-08.
How severe is CVE-2019-12410?: High severity. CVSS v3 base score is 7.5 out of 10.