CVE-2026-41486

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-41486
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41486.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-41486
Aliases
Downstream
CGA (3)
ECHO (1)
MINI (2)
Published
2026-05-08T21:46:14Z
Modified
2026-10-28T11:13:18Z
Severity
  • 8.9 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator
Summary
Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization
Details

Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types (ray.data.arrow_tensor, ray.data.arrow_tensor_v2, ray.data.arrow_variable_shaped_tensor) globally in PyArrow. When PyArrow reads a Parquet file containing one of these extension types, it calls arrow_ext_deserialize on the field's metadata bytes. Ray's implementation passes these bytes directly to cloudpickle.loads(), achieving arbitrary code execution during schema parsing, before any row data is read. This issue has been patched in version 2.55.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-502",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41486.json"
}
References

Affected packages

Git / github.com/ray-project/ray

Affected ranges

Type
GIT
Repo
https://github.com/ray-project/ray
Events
Introduced
48bd1f8fa43d0e8222b0f57357b99b48c7437ed3
Fixed
58af3fc5cad7e74001b3f89bffd9052a9e7aa2bb
Fixed
c02bd31ae31996805868baa446a131a8d304525f
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "2.54.0"
                },
                {
                    "fixed": "2.55.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "c02bd31ae31996805868baa446a131a8d304525f"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "ray-2.55.0",
            "range": [
                {
                    "fixed": "58af3fc5cad7e74001b3f89bffd9052a9e7aa2bb"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

2.*
2.54.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41486.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "89352426533390526306400048473442562869",
                "149893185171684037173978752784630430440",
                "44716456038091470909460406987887309391"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-41486-1da8ac6f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/ray-project/ray/commit/58af3fc5cad7e74001b3f89bffd9052a9e7aa2bb",
        "target": {
            "file": "src/ray/core_worker/tests/task_manager_test.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "152291613442518214913941930340978231063",
                "235559590780955171918987803798633389235",
                "15885339092108789021787133147444067839"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-41486-4f18aa21",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/ray-project/ray/commit/58af3fc5cad7e74001b3f89bffd9052a9e7aa2bb",
        "target": {
            "file": "src/ray/common/ray_config_def.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "198758771431606103182495938295389681778",
                "63028895006080680067531525587224201349",
                "87766133508859106114645854469648893778",
                "37272624478264194843256233491380417903",
                "110731609196691327413746682144545096671",
                "155226453649788732596519546318232032435",
                "133592465060740446061847189238187466743"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-41486-606c7597",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/ray-project/ray/commit/58af3fc5cad7e74001b3f89bffd9052a9e7aa2bb",
        "target": {
            "file": "src/ray/core_worker/task_manager.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "231614866152555909915319853350739806249",
                "269764720163032367547957257951840129756",
                "321405718273155449283046141059462075863",
                "328204968120684783934632880607160672250",
                "123922136334885125076407516650316827446",
                "125028329158292234658945890388293955237",
                "18543739986218424235321569001829939546",
                "315689795263205751263871435171604718285",
                "232064114306653163380901593932543358657",
                "246018328412869292456317552142473652084",
                "293772235433637886988325890800424340558",
                "72523926209178563798902208772931011209"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-41486-72b3f1e2",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/ray-project/ray/commit/58af3fc5cad7e74001b3f89bffd9052a9e7aa2bb",
        "target": {
            "file": "src/ray/core_worker/task_manager.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "289281450945726032448298080021553172366",
                "54185709377407162113609756900665075399",
                "309377755346502792770938141539172852926",
                "65880712103124925939446926893273408380",
                "3491554584826943630006433288987191377",
                "95482668852684428317731068015552501048",
                "262379263371488217602087086734836499583"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-41486-7c8712d0",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/ray-project/ray/commit/58af3fc5cad7e74001b3f89bffd9052a9e7aa2bb",
        "target": {
            "file": "src/ray/util/exponential_backoff.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "256625625241010152897777957896282407369",
            "length": 230
        },
        "id": "CVE-2026-41486-7ed9f845",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/ray-project/ray/commit/58af3fc5cad7e74001b3f89bffd9052a9e7aa2bb",
        "target": {
            "file": "src/ray/util/exponential_backoff.cc",
            "function": "ExponentialBackoff::GetBackoffMs"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "298730909065096319364869494727424169016",
                "301541128398313889044252268876269046200",
                "30008596438343283761931096570112405868",
                "242175218594659027716150684110115737425",
                "309769317108814437736385231729486732895",
                "278531911222355320187746760944737165138",
                "228287529784775002280620781335491046199",
                "102071637798532627240438396430130591718",
                "333854271898302681293464129994784708175"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-41486-b653e51f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/ray-project/ray/commit/58af3fc5cad7e74001b3f89bffd9052a9e7aa2bb",
        "target": {
            "file": "src/ray/util/tests/exponential_backoff_test.cc"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "71236028819869196675642093549054137994",
            "length": 3387
        },
        "id": "CVE-2026-41486-cb90c490",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/ray-project/ray/commit/58af3fc5cad7e74001b3f89bffd9052a9e7aa2bb",
        "target": {
            "file": "src/ray/core_worker/task_manager.cc",
            "function": "TaskManager::RetryTaskIfPossible"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:13:18Z"