CVE-2025-46762 Apache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a Parquet file metadata

🗓️ 06 May 2025 09:08:13Reported by apacheType

CVE-2025-46762 in Apache Parquet allows code execution from trusted packages; upgrade to 1.15.2 recommended.

Reporter	Title	Published	Views	Family All 25
IBM Security Bulletins	Security Bulletin: A vulnerability in Apache Parquet affect IBM® Db2® Big SQL.	23 Jan 202612:10	–	ibm
IBM Security Bulletins	Security Bulletin: Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code, which affects IBM watsonx.data	2 Sep 202514:00	–	ibm
ATTACKERKB	CVE-2025-46762	6 May 202510:15	–	attackerkb
BDU FSTEC	The vulnerability of the parquet-avro module in the Apache Parquet Java library, which allows a hacker to execute arbitrary code.	5 May 202500:00	–	bdu_fstec
Chainguard	CVE-2025-46762 vulnerabilities	3 Jun 202513:15	–	cgr
Circl	CVE-2025-46762	2 May 202506:25	–	circl
CNNVD	Apache Parquet 安全漏洞	6 May 202500:00	–	cnnvd
CVE	CVE-2025-46762	6 May 202509:08	–	cve
EUVD	EUVD-2025-13488	3 Oct 202520:07	–	euvd
Github Security Blog	Apache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a Parquet file metadata	6 May 202512:30	–	github

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.parquet:parquet-avro",
    "product": "Apache Parquet Java",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "1.15.1",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/t7724lpvl110xsbgqwsmrdsns0rhycdp

06 May 2025 09:08Current

CVSS 47.1

EPSS0.01446

CWE-73