Heap-based Buffer Overflow vulnerability in Apache ORC. A vulnerability has been identified in the ORC C++ LZO decompression logic, where specially crafted malformed ORC files can cause the decompressor to allocate a 250-byte buffer but then attempts to copy 295 bytes into it. It causes memory corruption. This issue affects Apache ORC C++ library: through 1.8.8, from 1.9.0 through 1.9.5, from 2.0.0 through 2.0.4, from 2.1.0 through 2.1.1. Users are recommended to upgrade to version 1.8.9, 1.9.6, 2.0.5, and 2.1.2, which fix the issue.
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
| Link | Tags |
|---|---|
| https://orc.apache.org/security/CVE-2025-47436/ | third party advisory vendor advisory |
| https://lists.apache.org/thread/kd6tlv8fs5jybmsgxr4vrkdxyc866wrn | vendor advisory mailing list |
| http://www.openwall.com/lists/oss-security/2025/05/13/4 | mailing list third party advisory |