ParquetSharp is a .NET library used for reading and writing Apache Parquet files. Between versions 18.1.0 and 23.0.0.1, the DecimalConverter.ReadDecimal function performs a stack allocation using a value supplied in the file. An attacker can construct a Parquet file that declares a decimal column with an unusually large width. When the library reads the file, it tries to allocate an overly large buffer on the stack, which can overflow and cause the process to crash. This type of flaw is classified as CWE‑789 and results in a denial‑of‑service outcome rather than privilege escalation or data exposure.

The vulnerability affects the G‑Research ParquetSharp library. All versions from 18.1.0 up to, but not including, 23.0.0.1 are vulnerable. Applications that use any of these versions to read untrusted Parquet files in a network service environment are at risk.

The CVSS score of 5.3 indicates a moderate risk. Because the exploit is achieved through the ingestion of a malformed Parquet file, an attacker who can supply such a file to a service that processes Parquet files can trigger the stack overflow. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog. The attack vector is inferred to be the upload or reception of a crafted Parquet file by a network service that relies on ParquetSharp.