PyPI/pyarrow CVE-2026-25087: high 7, EPSS 0.90%

Use After Free vulnerability in Apache Arrow C++.

Action: Upgrade pyarrow to 23.0.1 or later.

pip install pyarrow==23.0.1

Affected

Fixed versions

Sources

• osv: PYSEC-2026-113
• http://www.openwall.com/lists/oss-security/2026/02/17/4
• https://lists.apache.org/thread/mpm4ld1qony30tchfpjtk5b11tcyvmwh
• https://github.com/apache/arrow/pull/48925
• https://github.com/advisories/GHSA-rgxp-2hwp-jwgg

CVE-2026-25087 · published 2026-02-17T14:16:01.947Z · modified 2026-06-10T17:01:40.430051819Z · JSON