PT-2025-21026 · Apache · Apache Orc

Jason Villaluna · Published 2025-05-13 · Updated 2025-07-14 · CVE-2025-47436

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apache ORC versions 1.8.0 through 1.8.8 Apache ORC versions 1.9.0 through 1.9.5 Apache ORC versions 2.0.0 through 2.0.4 Apache ORC versions 2.1.0 through 2.1.1

Description: A Heap-based Buffer Overflow vulnerability has been identified in the ORC C++ LZO decompression logic. Specially crafted malformed ORC files can cause the decompressor to allocate a 250-byte buffer but then attempt to copy 295 bytes into it, resulting in memory corruption.

Recommendations: For Apache ORC versions 1.8.0 through 1.8.8, upgrade to version 1.8.9. For Apache ORC versions 1.9.0 through 1.9.5, upgrade to version 1.9.6. For Apache ORC versions 2.0.0 through 2.0.4, upgrade to version 2.0.5. For Apache ORC versions 2.1.0 through 2.1.1, upgrade to version 2.1.2.

Fix

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

AZL-61829

AZL-61836

CVE-2025-47436

Affected Products

Apache Orc

References · 12

• https://orc.apache.org/security/CVE-2025-47436 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-47436 · Vendor Advisory
• https://lists.apache.org/thread/kd6tlv8fs5jybmsgxr4vrkdxyc866wrn · Vendor Advisory
• https://osv.dev/vulnerability/AZL-61829 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-47436 · Security Note
• https://osv.dev/vulnerability/AZL-61836 · Vendor Advisory
• https://twitter.com/oss_security/status/1922313938756161926 · Twitter Post
• https://t.me/cvenotify/128866 · Telegram Post
• https://twitter.com/CVEnew/status/1922695640947253739 · Twitter Post
• http://openwall.com/lists/oss-security/2025/05/13/4 · Note
• https://t.me/cvetracker/23833 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1922661840321921515 · Twitter Post