Ray: From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types…
Ray
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Record
- CVE-2026-41486
- Affects
- Ray
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 8, 2026
- Source last modified
- June 17, 2026
Description
Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types (ray.data.arrow_tensor, ray.data.arrow_tensor_v2, ray.data.arrow_variable_shaped_tensor) globally in PyArrow. When PyArrow reads a Parquet file containing one of these extension types, it calls __arrow_ext_deserialize__ on the field's metadata bytes. Ray's implementation passes these bytes directly to cloudpickle.loads(), achieving arbitrary code execution during schema parsing, before any row data is read. This issue has been patched in version 2.55.0.
Description quoted from the NVD record.
Who is affected
Ray, made by Anyscale, is a system for spreading computing work, such as AI tasks, across many computers. This flaw affects versions 2.54.0 up to but not including 2.55.0, in Ray Data, the part of Ray that loads and processes data. If Ray Data reads a specially made Parquet file (a common format for storing tables of data), an attacker who created that file could run any commands they choose on the computer running Ray. This happens as soon as the file is opened, before any of its data is read. This flaw is rated High.
What to do
- The person who installed or runs Ray for your organization should check which version is in use. Versions 2.54.0 up to but not including 2.55.0 have this flaw.
- If an affected version is in use, update Ray to version
2.55.0, which fixes this flaw. - If an IT provider or vendor runs Ray for your organization, send them this advisory and ask when the update to version
2.55.0will be done. - If you are not sure whether Ray is used anywhere in your organization, ask the person who looks after your computers before assuming this flaw does not apply.
Analysis written from the source record as of June 17, 2026 and reviewed before publishing.