VYPR
← All advisories
Critical severity9.8NVD Advisory· Published May 14, 2025· Updated Jun 17, 2026

CVE-2025-47436

CVE-2025-47436

Description

Heap-based Buffer Overflow vulnerability in Apache ORC.

A vulnerability has been identified in the ORC C++ LZO decompression logic, where specially crafted malformed ORC files can cause the decompressor to allocate a 250-byte buffer but then attempts to copy 295 bytes into it. It causes memory corruption.

This issue affects Apache ORC C++ library: through 1.8.8, from 1.9.0 through 1.9.5, from 2.0.0 through 2.0.4, from 2.1.0 through 2.1.1.

Users are recommended to upgrade to version 1.8.9, 1.9.6, 2.0.5, and 2.1.2, which fix the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Apache/ORC2 versions
    cpe:2.3:a:apache:orc:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:apache:orc:*:*:*:*:*:*:*:*range: <1.8.9
    • (no CPE)range: through 1.8.8, from 1.9.0 through 1.9.5, from 2.0.0 through 2.0.4, from 2.1.0 through 2.1.1
  • Apache/Apachecpe-rescue
    Range: 0

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.