The Apache Arrow Rust library suffered an out-of-bounds read due to insufficient validation of RunEndEncoded arrays in the ArrayData interface. This flaw allows an adversary to read memory beyond the bounds of the child values array, exposing arbitrary data that resides in memory. The nature of the weakness aligns with CWE-125 and can lead to information disclosure or corruption of data consumed by the application.

Apache Arrow Rust is impacted across crate versions 33.0.0 through 60.0.0, inclusive. The publicly recommended remedial releases are 60.1.0, 59.3.2, 58.4.1, and 57.3.2, which contain the necessary boundary checks to prevent the overflow.

No EPSS score is currently available and the vulnerability is not listed in the CISA KEV catalog. While the CVSS score is not disclosed, the lack of exploitation data suggests a moderate risk profile, contingent on the adoption of the vulnerable crate. The likely attack vector is local or application‑bound, as the vulnerability is triggered when a malicious or malformed RunEndEncoded array is processed. If Arrow is used within a service that accepts external input, remote exploitation could be possible by sending crafted data to the service.