CVE-2024-52338 – Apache Arrow R package: Arbitrary code execution when loading a malicious data file

https://notcve.org/view.php?id=CVE-2024-52338

28 Nov 2024 — Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example, user-supplied input files). This vulnerability only affects the arrow R package, not other Apache Arrow implementations or bindings unless those bindings are specifically used via the R package (for example, an R application that embeds a Python... • https://github.com/apache/arrow/commit/801de2fbcf5bcbce0c019ed4b35ff3fc863b141b • CWE-502: Deserialization of Untrusted Data •