BUG: Compiler Flag Drift May Affect Pandas ABI Stability via Memory Assumptions

[BryteLite]

Pandas version checks

• I have checked that this issue has not already been reported.

• I have confirmed this bug exists on the latest version of pandas.

• I have confirmed this bug exists on the main branch of pandas.

Reproducible Example

import pandas as pd
import numpy as np

# Create a structured array with alignment-sensitive types
dtype = np.dtype([('x', np.int64), ('y', np.float64)])
arr = np.zeros(10, dtype=dtype)

# Wrap into DataFrame
df = pd.DataFrame(arr)

# Trigger complex alignment path
try:
    # Operation that depends on consistent field layout
    df_sum = df.sum(numeric_only=True)
    print("Sum result:", df_sum)
except Exception as e:
    print("Failure during structured alignment test:", e)

Issue Description

Summary

Pandas may be vulnerable to ABI and memory alignment issues caused by C23 default behaviors in GCC 15.1. Silent adoption of padding behavior changes — particularly in union or struct definitions used in NumPy or Pandas C extensions — may lead to unpredictable runtime behavior.

This issue was originally identified in NumPy and Cython. As Pandas includes both compiled Cython code and relies on NumPy for internal memory layout, it is downstream vulnerable.

These compiled pieces are sensitive to pointer alignment, ABI expectations, or padding behaviors — especially across environments.

Reproducible Example

Please see section below

Possibly related to:

• BUG: DataFrame constructor not compatible with array-like classes that have a 'name' attribute
• BUG: Confusing Behavior When Assigning DataFrame Columns Using omegaconf.ListConfig
• BUG: Some ExtensionArrays can return 0-d Elements
• BUG: Joining Pandas with Polars dataframe produces fuzzy errormessage
• BUG: documented usage of of str.split(...).str.get fails on dtype large_string[pyarrow]

Report for more context:
Report

Expected Behavior

Recompile NumPy and Pandas with mismatched flags.

Then run the If padding bits are not cleared correctly in C structs, or if a layout mismatch occurs due to vendor/flag drift, crashes or incorrect math results may emerge.

CFLAGS="-std=c23" pip install numpy pandas --force-reinstall --no-cache-dir when #building

Installed Versions

NumPy latest 3.13 release, Pandas latest 3.13 release are suitable.

[BryteLite]

NumPy just released 2.2.6 fixes concerning types today. Might just mask the issue however.

[eli-schwartz]

https://sethmlarson.dev/slop-security-reports

[rhshadrach]

Thanks @eli-schwartz - closing along with matplotlib/matplotlib#30064 and numpy/numpy#28953