CVE-2023-47248observed exploitationCWE-502

CVE-2023-47248: vulnerability in Apache Software Foundation PyArrow

PyArrow, PyArrow: Arbitrary code execution when loading a malicious data file

Published · Updated

Follow this CVE+ Monitor PyArrow+ Monitor pyarrow

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

45Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actepss 15%
from disclosure to weapon
Published on NVDNov 9
VulnCheck+493d
Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied input files). This vulnerability only affects PyArrow, not other Apache Arrow implementations or bindings. It is recommended that users of PyArrow upgrade to 14.0.1. Similarly, it is recommended that downstream libraries upgrade their dependency requirements to PyArrow 14.0.1 or later. PyPI packages are already available, and we hope that conda-forge packages will be available soon. If it is not possible to upgrade, we provide a separate package `pyarrow-hotfix` that disables the vulnerability on older PyArrow versions. See https://pypi.org/project/pyarrow-hotfix/ for instructions.
Affected products
Apache Software Foundation · PyArrow
Related CVEs — Apache Software Foundation PyArrow

In the same product, most dangerous first.

CVE-2026-92287HIGHApache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validationEPSS 0.4%