CVE-2025-47436

CRITICAL

9.8

Description

Heap-based Buffer Overflow vulnerability in Apache ORC. A vulnerability has been identified in the ORC C++ LZO decompression logic, where specially crafted malformed ORC files can cause the decompressor to allocate a 250-byte buffer but then attempts to copy 295 bytes into it. It causes memory corruption. This issue affects Apache ORC C++ library: through 1.8.8, from 1.9.0 through 1.9.5, from 2.0.0 through 2.0.4, from 2.1.0 through 2.1.1. Users are recommended to upgrade to version 1.8.9, 1.9.6, 2.0.5, and 2.1.2, which fix the issue.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie5/14/2025

Derniere modification7/14/2025

Sourcenvd

Observations honeypot0

Produits affectes

apache:orc

Faiblesses (CWE)

CWE-122

References

https://lists.apache.org/thread/kd6tlv8fs5jybmsgxr4vrkdxyc866wrn(security@apache.org)

https://orc.apache.org/security/CVE-2025-47436/(security@apache.org)

http://www.openwall.com/lists/oss-security/2025/05/13/4(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.