Home

Description

Heap-based Buffer Overflow vulnerability in Apache ORC. A vulnerability has been identified in the ORC C++ LZO decompression logic, where specially crafted malformed ORC files can cause the decompressor to allocate a 250-byte buffer but then attempts to copy 295 bytes into it. It causes memory corruption. This issue affects Apache ORC C++ library: through 1.8.8, from 1.9.0 through 1.9.5, from 2.0.0 through 2.0.4, from 2.1.0 through 2.1.1. Users are recommended to upgrade to version 1.8.9, 1.9.6, 2.0.5, and 2.1.2, which fix the issue.

PUBLISHED Reserved 2025-05-07 | Published 2025-05-14 | Updated 2025-05-14 | Assigner apache




MEDIUM: 6.0CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/S:N/RE:M/U:Amber

Problem types

CWE-122 Heap-based Buffer Overflow

Product status

Default status
unaffected

Any version
affected

1.9.0 (semver)
affected

2.0.0 (semver)
affected

2.1.0 (semver)
affected

Credits

Jason Villaluna reporter

References

www.openwall.com/lists/oss-security/2025/05/13/4

orc.apache.org/security/CVE-2025-47436/ vendor-advisory

lists.apache.org/thread/kd6tlv8fs5jybmsgxr4vrkdxyc866wrn mailing-list

cve.org (CVE-2025-47436)

nvd.nist.gov (CVE-2025-47436)

Download JSON

Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.