CVE-2026-25087: 
Python vulnerability analysis and mitigation

CVE-2026-25087 is a Use After Free vulnerability in Apache Arrow C++ that can be triggered when reading an Arrow IPC file (not an IPC stream) with pre-buffering enabled, if the file contains variadic buffer data types such as Binary View or String View. It affects Apache Arrow C++ versions 15.0.0 through 23.0.0; version 23.0.1 is unaffected. Language bindings (Python, Ruby, C GLib) are not vulnerable as they do not expose the pre-buffering API. The vulnerability was disclosed on February 17, 2026, and carries a CVSS v3.1 base score of 7.0 (High) (Feedly, oss-security).

The root cause is a Use After Free (CWE-416) combined with an Expired Pointer Dereference (CWE-825) in the IPC file reader's pre-buffering code path. When RecordBatchFileReader::PreBufferMetadata is enabled, a race condition in multi-threaded I/O can cause a write to a dangling pointer — specifically, a std::shared_ptr<Buffer> object is written to freed memory depending on the number of variadic buffers in a record batch column and the temporal sequence of concurrent I/O operations. The attacker does not have direct control over the value written to the dangling pointer, which limits the exploitability of the flaw. The fix, merged in GitHub PR #48925, addresses the bug by correcting variadic buffer handling with pre-buffering enabled, fixing dictionary pre-buffering, and validating IPC buffer offsets and lengths (GitHub PR, oss-security).

The most likely consequence of exploitation is random crashes or memory corruption when processing specific IPC files, making denial of service the primary risk for applications that ingest IPC files from untrusted sources. More targeted impacts such as confidential data extraction from the running process are theoretically possible but depend on memory allocation patterns and multi-threaded I/O timing that are unlikely to be reliably controlled by an attacker. The CVSS assessment reflects high availability impact with low confidentiality and integrity impact (oss-security, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.038%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires that the target application explicitly enables pre-buffering via RecordBatchFileReader::PreBufferMetadata and processes attacker-supplied IPC files containing variadic buffer data. The vulnerability was reported by researchers credited as "emi" / "rootkid19" (oss-security, Feedly).

1. Identify target applications: Locate C++ applications using Apache Arrow versions 15.0.0–23.0.0 that explicitly call RecordBatchFileReader::PreBufferMetadata to enable pre-buffering on IPC file readers, and that accept IPC files from external or untrusted sources.
2. Craft a malicious IPC file: Create an Arrow IPC file (not an IPC stream) containing record batch columns with a large number of variadic buffers, specifically using Binary View or String View data types, to maximize the likelihood of triggering the race condition.
3. Submit the file: Deliver the crafted IPC file to the target application through any available ingestion mechanism (e.g., file upload, API endpoint, shared storage).
4. Trigger the race condition: The application reads the IPC file with pre-buffering enabled; under multi-threaded I/O, the timing-dependent use-after-free may cause a write to a dangling std::shared_ptr<Buffer> pointer.
5. Achieve denial of service: The most reliable outcome is a crash or memory corruption in the application process, resulting in denial of service (oss-security, GitHub PR).

• Logs: Application crash logs or core dumps from processes using Apache Arrow C++ IPC file reading, particularly with stack traces referencing RecordBatchFileReader, variadic buffer handling, or std::shared_ptr destruction.
• Process: Unexpected termination (SIGSEGV, SIGABRT) of services that process Arrow IPC files; ASAN/UBSAN reports indicating use-after-free in Arrow IPC reader code paths.
• File System: Presence of unusual or externally sourced .arrow or .ipc files containing Binary View or String View data types submitted to the application's ingestion directory.
• Network: Repeated submission of IPC files from the same external source, especially if followed by application crashes or restarts (oss-security).

Upgrade Apache Arrow C++ to version 23.0.1 or later, which contains the fix for this vulnerability. If an immediate upgrade is not possible, disable pre-buffering by removing or not calling RecordBatchFileReader::PreBufferMetadata — note this may have adverse performance consequences. Applications using only language bindings (Python, Ruby, C GLib) are not affected and require no action. Prioritize patching systems where Arrow C++ processes IPC files from untrusted or external sources with pre-buffering explicitly enabled (oss-security, Red Hat Bugzilla, Apache Arrow Blog).

The vulnerability was disclosed by Apache Arrow maintainer Antoine Pitrou via the oss-security mailing list on February 17, 2026, with credit to reporters "emi" / "rootkid19". Red Hat tracked the issue in their Bugzilla system and assigned it medium severity. Community discussion was noted on Bluesky and security aggregator sites shortly after disclosure. No major media coverage or significant controversy has been observed (oss-security, Red Hat Bugzilla).