Arbitrary Code Execution (ACE)

🗓️ 13 May 2025 04:17:26Reported by Veracode Vulnerability DatabaseType

Vulnerability in parquet-avro allows arbitrary code execution via malicious Parquet files.

Reporter	Title	Published	Views	Family All 25
IBM Security Bulletins	Security Bulletin: A vulnerability in Apache Parquet affect IBM® Db2® Big SQL.	23 Jan 202612:10	–	ibm
IBM Security Bulletins	Security Bulletin: Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code, which affects IBM watsonx.data	2 Sep 202514:00	–	ibm
ATTACKERKB	CVE-2025-46762	6 May 202510:15	–	attackerkb
Chainguard	CVE-2025-46762 vulnerabilities	3 Jun 202513:15	–	cgr
Circl	CVE-2025-46762	2 May 202506:25	–	circl
CNNVD	Apache Parquet 安全漏洞	6 May 202500:00	–	cnnvd
CVE	CVE-2025-46762	6 May 202509:08	–	cve
Cvelist	CVE-2025-46762 Apache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a Parquet file metadata	6 May 202509:08	–	cvelist
EUVD	EUVD-2025-13488	3 Oct 202520:07	–	euvd
Github Security Blog	Apache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a Parquet file metadata	6 May 202512:30	–	github

Vulners

Node

apache parquet-avroRange1.7.0–1.15.1java

Source	Link
lists	www.lists.apache.org/thread/t7724lpvl110xsbgqwsmrdsns0rhycdp
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-46762
openwall	www.openwall.com/lists/oss-security/2025/05/02/1
issues	www.issues.apache.org/jira/browse/AVRO-3985
github	www.github.com/apache/parquet-java

13 Dec 2025 04:25Current

7.9High risk

Vulners AI Score7.9

CVSS 3.18.1

CVSS 47.1

EPSS0.0038

SSVC