A memory corruption vulnerability in Apache Arrow C++ affects versions 15.0.0 through 23.0.0 and may allow for denial of service attacks via malicious IPC files.

This is a Use After Free flaw (CWE-416) triggered during the reading of Arrow IPC files with pre-buffering enabled. The vulnerability requires no authentication and can be triggered by an attacker providing a specially crafted IPC file containing variadic buffers.

The primary business risk involves system instability and potential denial of service if the application processes untrusted IPC files. Given the CVSS score of 7.0, this issue presents a significant risk to data availability and system integrity, as memory corruption can lead to unpredictable application behavior or service crashes.

Immediate Action: Update Apache Arrow to version 23.0.1 or later. If using the Python ecosystem, update the pyarrow package to the corresponding version.

Proactive Monitoring: Monitor application error logs for frequent crashes or segmentation faults, particularly when ingesting data from external or untrusted sources.

Compensating Controls: Ensure that the pre-buffering functionality (RecordBatchFileReader::PreBufferMetadata) is disabled if not strictly required for performance, as this feature is the primary vector for the flaw.

Public Exploit Available: Unknown.

Organizations utilizing Apache Arrow C++ should prioritize upgrading to version 23.0.1 to eliminate the underlying memory management defect. While the attack vector requires specific configuration settings, the risk of service disruption is sufficient to warrant immediate patch deployment across all affected development and production environments.