CVE-2024-52338

Apache Arrow R package: Arbitrary code execution when loading a malicious data file

Description

Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example, user-supplied input files). This vulnerability only affects the arrow R package, not other Apache Arrow implementations or bindings unless those bindings are specifically used via the R package (for example, an R application that embeds a Python interpreter and uses PyArrow to read files from untrusted sources is still vulnerable if the arrow R package is an affected version). It is recommended that users of the arrow R package upgrade to 17.0.0 or later. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to arrow 17.0.0 or later. If using an affected version of the package, untrusted data can read into a Table and its internal to_data_frame() method can be used as a workaround (e.g., read_parquet(..., as_data_frame = FALSE)$to_data_frame()). This issue affects the Apache Arrow R package: from 4.0.0 through 16.1.0. Users are recommended to upgrade to version 17.0.0, which fixes the issue.

Category

9.8
CVSS
Severity: Critical
CVSS 3.1 •
EPSS 0.90% Top 30%
Vendor Advisory apache.org
Affected: Apache Software Foundation Apache Arrow R package
Published at:
Updated at:

References

Link Tags
https://github.com/apache/arrow/commit/801de2fbcf5bcbce0c019ed4b35ff3fc863b141b patch
https://lists.apache.org/thread/0rcbvj1gdp15lvm23zm601tjpq0k25vt vendor advisory
http://www.openwall.com/lists/oss-security/2024/11/28/3

Frequently Asked Questions

What is the severity of CVE-2024-52338?
CVE-2024-52338 has been scored as a critical severity vulnerability.
How to fix CVE-2024-52338?
To fix CVE-2024-52338, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-52338 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2024-52338 is being actively exploited. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-52338?
CVE-2024-52338 affects Apache Software Foundation Apache Arrow R package.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.