CVE-2019-12408

Root

Cause

Apache Arrow versions 0.14.0 and 0.14.1 contain an uninitialized memory bug in the C++ implementation (which also underlies the R, Python, and Ruby bindings). When building arrays that include null values in certain scenarios, memory that has not been properly initialized can be left in the array buffers [1].

Exploitation

No special authentication or network position is required beyond the ability to receive Arrow data. The vulnerability manifests when Arrow Arrays built under these conditions are serialized and transmitted—either over the wire via Arrow Flight or persisted using the streaming IPC and file formats. An attacker who can receive such serialized data may observe the uninitialized memory content [1].

Impact

Because the uninitialized memory can contain residual data from the process, an attacker could extract sensitive information that was previously stored in memory by the same application. This constitutes a confidentiality breach [1][2][3].

Mitigation

The issue is fixed in Apache Arrow 0.14.2 and later. Users of the affected versions should upgrade immediately. The advisory is also tracked in the Ruby (red-arrow) and Python (pyarrow) security databases, confirming the broad impact across language bindings [2][3].