A use‑after‑free flaw exists in Apache Arrow C++ when reading IPC files that contain variadic buffers and the reader’s pre‑buffering feature is enabled. The vulnerability can cause a write to a dangling pointer, resulting in memory corruption or random crashes. Although the value written is not directly attacker controlled, the effect can lead to denial of service or, in rare assembly patterns, potential confidentiality leakage in a running process. The weakness corresponds to CWE‑416 and CWE‑825.

Apache Arrow C++ library versions 15.0.0 through 23.0.0 are affected when the C++ API RecordBatchFileReader::PreBufferMetadata is used to enable pre‑buffering. Language bindings such as Python, Ruby, and C GLib do not expose the vulnerable API and are therefore not vulnerable. Any application that incorporates these C++ versions and ingests IPC files from untrusted sources could be impacted.

The CVSS score is 7, indicating high severity, but the EPSS score of less than 1 % suggests that exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. The attack route requires an attacker to supply a specially crafted IPC file to an application that has enabled pre‑buffering via the C++ API; this is typically an internal or local threat. The most probable consequence is application crashes or service disruption, with remote code execution being improbable unless additional memory corruption conditions are met.