{"cve":"CVE-2025-46762","nvd":{"published":"2025-05-06T10:15:16.047","modified":"2026-06-17T09:26:55.977","status":"Analyzed","description":"Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code.\n\nWhile 1.15.1 introduced a fix to restrict untrusted packages, the default setting of trusted packages still allows malicious classes from these packages to be executed.\n\nThe exploit is only applicable if the client code of parquet-avro uses the \"specific\" or the \"reflect\" models deliberately for reading Parquet files. (\"generic\" model is not impacted)\n\nUsers are recommended to upgrade to 1.15.2 or set the system property \"org.apache.parquet.avro.SERIALIZABLE_PACKAGES\" to an empty string on 1.15.1. Both are sufficient to fix the issue.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/S:N/RE:M/U:Amber","score":7.1},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1},"cwes":["CWE-73"],"references":["https://lists.apache.org/thread/t7724lpvl110xsbgqwsmrdsns0rhycdp","http://www.openwall.com/lists/oss-security/2025/05/02/1"],"products":["apache:parquet"],"source":"nvd","synced_at":"2026-10-19T22:01:22.920403922+00:00"},"epss":{"cve":"CVE-2025-46762","score":0.01593,"percentile":0.757,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-53wx-pr6q-m3j5","url":"https://osv.dev/vulnerability/GHSA-53wx-pr6q-m3j5","summary":"Apache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a Parquet file metadata","modified":"2026-09-10T03:50:24.261677509Z","packages":[{"ecosystem":"Maven","name":"org.apache.parquet:parquet-avro","purl":"pkg:maven/org.apache.parquet/parquet-avro","ranges":["<1.15.2"],"fixed":["1.15.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}