5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42241

CVE-2026-42241: ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width

DecimalConverter.ReadDecimal makes a stackalloc using what might be an attacker-supplied value. If an attacker declares a decimal column with some unreasonable width, this could lead to a stack overflow. In a service environment, this would potentially take down a service.

This affects applications using ParquetSharp to read untrusted Parquet files in a network service.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42241

CVE-2026-42241:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
ParquetSharp	nuget	>= 18.1.0, < 23.0.0.1	23.0.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the ParquetSharp.DecimalConverter.ReadDecimal method, which is responsible for converting decimal values from the Parquet format. The core issue, as identified in commit 6824d297f9c7a798222fa6cfc693f0f954a2b08f, is the use of stackalloc to create a temporary buffer. The size of this buffer is determined by byteArray.Length, a value that is read from the Parquet file's metadata. A malicious actor can create a Parquet file with an unusually large typeWidth for a decimal column. When ParquetSharp attempts to read this column, it calls ReadDecimal, which then tries to allocate an excessively large buffer on the stack. This leads to a StackOverflowException, crashing the application. The patch mitigates this by introducing a size limit (MaxStackAllocSize). If the required buffer size is below this limit, it safely uses stackalloc; otherwise, it falls back to a heap-based allocation using ArrayPool<byte>.Shared.Rent(), which is not subject to the same size constraints as the stack. The WriteDecimal function was also patched as it contained the same vulnerable stackalloc pattern.

Vulnerable functions

ParquetSharp.DecimalConverter.ReadDecimal

csharp/DecimalConverter.cs

The function `ReadDecimal` uses `stackalloc` to allocate a buffer on the stack. The size of this buffer is determined by `byteArray.Length`, which is derived from the metadata of the Parquet file. An attacker can craft a malicious Parquet file with a decimal column of an extremely large width, causing this allocation to be huge and leading to a stack overflow when the file is read.

ParquetSharp.DecimalConverter.WriteDecimal

csharp/DecimalConverter.cs

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.