CVE-2025-47436 Apache ORC: Potential Heap Buffer Overflow during C++ LZO Decompression
Heap buffer overflow in Apache ORC C++ LZO decompression allows attackers to cause memory corruption via crafted files, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-47436?
CVE-2025-47436 is a medium-severity memory corruption vulnerability in Apache ORC, published on 14 May 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Heap-based Buffer Overflow vulnerability in Apache ORC.
A vulnerability has been identified in the ORC C++ LZO decompression logic, where specially crafted malformed ORC files can cause the decompressor to allocate a 250-byte buffer but then attempts to copy 295 bytes into it. It causes memory corruption.
This issue affects Apache ORC C++ library: through 1.8.8, from 1.9.0 through 1.9.5, from 2.0.0 through 2.0.4, from 2.1.0 through 2.1.1.
Users are recommended to upgrade to version 1.8.9, 1.9.6, 2.0.5, and 2.1.2, which fix the issue.
Weakness: CWE-122
Which versions are affected by CVE-2025-47436?
It affects 1 product.
Products include Apache Orc.
How do I fix CVE-2025-47436?
No fix has been published for CVE-2025-47436 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-47436 being exploited?
There is no known exploitation of CVE-2025-47436 in the wild and no public exploit code.
Other vulnerabilities in Apache ORC
Sources
Also known as AZL-61829, AZL-61836, GHSA-h527-m3cp-9hm7.