CVE-2026-42241 — Applications Using ParquetSharp To Read Untrusted Parquet Fi Vulnerability

title: Potential Stack Overflow via Malformed Parquet Decimal Column - CVE-2026-42241
id: scw-2026-05-07-ai-1
status: experimental
level: high
description: |
  This rule detects the execution of .NET applications that appear to be interacting with ParquetSharp.dll and are attempting to process Parquet files with excessively large decimal widths. This specific pattern is indicative of an attempt to exploit CVE-2026-42241, which involves a stack overflow vulnerability in the DecimalConverter.ReadDecimal method when processing malformed Parquet files with unreasonable decimal widths, potentially leading to a denial of service.
author: SCW Feed Engine (AI-generated)
date: 2026-05-07
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-42241/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: process_creation
detection:
  selection:
      Image|startswith:
          - 'C:\Program Files\'
          - '/usr/bin/'
      CommandLine|contains:
          - 'dotnet'
      CommandLine|contains:
          - 'ParquetSharp.dll'
      CommandLine|contains:
          - '--decimal-width'
      CommandLine|contains:
          - '2147483647' # Max int value, often used to test boundaries
  selection_base:
      Image|startswith:
          - 'C:\Program Files\'
          - '/usr/bin/'
  selection_indicators:
      CommandLine|contains:
          - 'dotnet'
      CommandLine|contains:
          - 'ParquetSharp.dll'
      CommandLine|contains:
          - '--decimal-width'
      CommandLine|contains:
          - '2147483647'
  condition: selection_base AND selection_indicators
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse