# CVE-2024-52338: PYSEC-2024-161 - Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions…

Source: https://junglewise.ai/threats/cve-2024-52338-pysec-2024-161-deserialization-of-untrusted-data-in-ipc-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-11-28  
License: CC BY 4.0 with a link back

CVE-2024-52338 · Severity: info · Published 2024-11-28

Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it 
reads Arrow IPC, Feather or Parquet data from untrusted sources (for 
example, user-supplied input files). This vulnerability only affects the arrow R package, not other Apache Arrow 
implementations or bindings unless those bindings are specifically used via the R package (for example, an R application that embeds a Python interpreter and uses PyArrow to read files from untrusted sources is still vulnerable if the arrow R package is an affected version). It is recommended that users of the arrow R package upgrade to 17.0.0 or later. Similarly, it
 is recommended that downstream libraries upgrade their dependency 
requirements to arrow 17.0.0 or later. If using an affected
version of the package, untrusted data can read into a Table and its internal to_data_frame() method can be used as a workaround (e.g., read_parquet(..., as_data_frame = FALSE)$to_data_frame()).


This issue affects the Apache Arrow R package: from 4.0.0 through 16.1.0.


Users are recommended to upgrade to version 17.0.0, which fixes the issue.

Technologies: [pyarrow (PyPI)](https://junglewise.ai/threats/technologies/pyarrow). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2024-52338 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-52338 being exploited in the wild.

**How severe is CVE-2024-52338?** Informational severity, published 28 November 2024.

**Which products and versions are affected?** pyarrow (PyPI) GIT:introduced=0,fixed=801de2fbcf5bcbce0c019ed4b35ff3fc863b141b|ECOSYSTEM:introduced=4.0.0,fixed=17.0.0.

**Is there a fix for CVE-2024-52338?** Yes. pyarrow (PyPI): upgrade to 17.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2024-52338?** Check whether you run pyarrow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pyarrow (PyPI): upgrade to 17.0.0 or later

  ```sh
  pip install "pyarrow>=17.0.0"
  ```


## Affected products

- pyarrow (PyPI) GIT:introduced=0,fixed=801de2fbcf5bcbce0c019ed4b35ff3fc863b141b|ECOSYSTEM:introduced=4.0.0,fixed=17.0.0

## Identifiers

- CVE-2024-52338
- PYSEC-2024-161

## Related threats

- [Apache Arrow C++ use-after-free in IPC file reader](https://junglewise.ai/threats/cve-2026-25087-apache-arrow-c-use-after-free-in-ipc-file-reader)
- [PyArrow: Arbitrary code execution when loading a malicious data file](https://junglewise.ai/threats/cve-2023-47248-pyarrow-arbitrary-code-execution-when-loading-a-malicious-data)
- [Missing Initialization of Resource in Apache Arrow](https://junglewise.ai/threats/cve-2019-12410-missing-initialization-of-resource-in-apache-arrow)
- [Missing Initialization of Resource in Apache Arrow](https://junglewise.ai/threats/cve-2019-12408-missing-initialization-of-resource-in-apache-arrow)