CVE-2026-42241

{
  "id": "CVE-2026-42241",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-07T20:16:44.247",
  "lastModified": "2026-10-26T20:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ParquetSharp is a .NET library for reading and writing Apache Parquet files. From version 18.1.0 to before version 23.0.0.1, DecimalConverter.ReadDecimal makes a stackalloc using what might be an attacker-supplied value. If an attacker declares a decimal column with some unreasonable width, this could lead to a stack overflow. In a service environment, this would potentially take down a service. This affects applications using ParquetSharp to read untrusted Parquet files in a network service. This issue has been patched in version 23.0.0.1."
    },
    {
      "lang": "es",
      "value": "ParquetSharp es una biblioteca .NET para leer y escribir archivos Apache Parquet. Desde la versión 18.1.0 hasta antes de la versión 23.0.0.1, DecimalConverter.ReadDecimal realiza un stackalloc utilizando lo que podría ser un valor proporcionado por un atacante. Si un atacante declara una columna decimal con un ancho irrazonable, esto podría llevar a un desbordamiento de pila. En un entorno de servicio, esto podría potencialmente derribar un servicio. Esto afecta a las aplicaciones que utilizan ParquetSharp para leer archivos Parquet no confiables en un servicio de red. Este problema ha sido parcheado en la versión 23.0.0.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "G-Research",
          "product": "ParquetSharp",
          "versions": [
            {
              "version": ">= 18.1.0, < 23.0.0.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-08T14:38:23.750570Z",
          "id": "CVE-2026-42241",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-789"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/G-Research/ParquetSharp/releases/tag/23.0.0.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/G-Research/ParquetSharp/security/advisories/GHSA-rrjr-v56m-ww88",
      "source": "[email protected]"
    }
  ]
}