CVE-2025-30065: Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata

10.0 CVSS

Description

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code

Users are recommended to upgrade to version 1.15.1, which fixes the issue.

CVSS Base Severity: CRITICAL

CVSS Base Score: 10.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Vendor: Apache Software Foundation

Product: Apache Parquet Java

EPSS Score: 0.16% (probability of being exploited)

EPSS Percentile: 37.52% (scored less or equal to compared to others)

EPSS Date: 2025-04-18 (when was this score calculated)

2025-04-01 08:40:22 UTC
CVE

Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata