A separate bulletin by Endor Labs highlights the risk of CVE-2025-30065 exploitation more clearly, warning that the flaw can impact any data pipelines and analytics systems that import Parquet files, with the risk being significant for files sourced from external points. The problem stems from the deserialization of untrusted data that could allow attackers with specially crafted Parquet files to gain control of target systems, exfiltrate or modify data, disrupt services, or introduce dangerous payloads such as ransomware. Although no active exploitation has been discovered yet, the risk is high due to the flaw's severity and the widespread use of Parquet files in big data applications. "If an attacker tricks a vulnerable system into reading a specially crafted Parquet file, they could gain remote code execution (RCE) on that system," warns Endor Labs. Apache Parquet is an open-source, columnar storage format designed for efficient data processing. "Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code," warned the short bulletin published on Openwall. That being said, if upgrading to Apache Parquet 1.15.1 immediately is impossible, it is suggested to avoid untrusted Parquet files or carefully validate their safety before processing them. Unlike row-based formats (like CSV), Parquet stores data by columns, which makes it faster and more space-efficient for analytical workloads. Endor Labs believes the problem was introduced in Parquet version 1.8.0, though older releases might also be impacted.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Thu, 03 Apr 2025 21:30:14 +0000