The vulnerability resides in Ray’s handling of custom PyArrow extension types during Parquet file parsing. When a Parquet file contains one of the Ray‑specific Arrow extension types, Ray calls __arrow_ext_deserialize__ on metadata bytes and directly passes them to cloudpickle.loads(). This deserialization bypasses safety checks and allows arbitrary Python code to execute with whatever privileges Ray is running under, leading to full compromise of the host system.

Ray versions starting from 2.54.0 up to, but not including, 2.55.0 are affected. The impact applies to any environment where Ray registers the custom extension types globally in PyArrow and processes external Parquet files.

The CVSS score of 8.9 indicates high severity. The EPSS score is not available, so the actual exploitation frequency is unclear, and Ray is not listed in the CISA KEV catalog. The likely attack vector is inferred: an adversary who can supply a crafted Parquet file to a Ray application will trigger the unsafe deserialization path, delivering remote code execution before any row data is read. A patch is available in Ray 2.55.0, which removes the unsafe deserialization.