Buffer overflow in Apache Orc
CVE-2025-47436
Heap-based Buffer Overflow vulnerability in Apache ORC. A vulnerability has been identified in the ORC C++ LZO decompression logic, where specially crafted malformed ORC files can cause the decompressor to allocate a 250-byte buffer but then attempts to copy 295 bytes into it. It causes memory corruption. This issue affects Apache ORC C++ library: through 1.8.8, from 1.9.0 through 1.9.5, from 2.0.0 through 2.0.4, from 2.1.0 through 2.1.1. Users are recommended to upgrade to version 1.8.9, 1.9.6, 2.0.5, and 2.1.2, which fix the issue.
Vulnerability class: Buffer Overflow
EPSS: 0.005 (38.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Orc
- Apache Software Foundation Orc — versions 0, 1.9.0, 2.0.0
Weakness classification (CWE)
References
- security@apache.org (vendor-advisory, Third Party Advisory)
- security@apache.org (Vendor Advisory, mailing-list, Mailing List)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-47436?
- CVE-2025-47436 is a critical-severity vulnerability in Apache Orc, classified under Heap-based Buffer Overflow. CVSS score: 9.8/10. Published 2025-05-14.
- How severe is CVE-2025-47436?
- Critical severity. CVSS v3 base score is 9.8 out of 10.