CVE-2025-47436

Katalog CVE

CVSS 9.8 · Critical EPSS 0,57%

Kerentanan Heap-based Buffer Overflow pada apache orc. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Heap-based Buffer Overflow vulnerability in Apache ORC. A vulnerability has been identified in the ORC C++ LZO decompression logic, where specially crafted malformed ORC files can cause the decompressor to allocate a 250-byte buffer but then attempts to copy 295 bytes into it. It causes memory corruption. This issue affects Apache ORC C++ library: through 1.8.8, from 1.9.0 through 1.9.5, from 2.0.0 through 2.0.4, from 2.1.0 through 2.1.1. Users are recommended to upgrade to version 1.8.9, 1.9.6, 2.0.5, and 2.1.2, which fix the issue.

Rincian

Terbit di NVD

14 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow

EPSS (30 hari)

0,57% peluang dieksploitasi; lebih tinggi dari 45,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/kd6tlv8fs5jybmsgxr4vrkdxyc866wrn mailing list · advisory vendor
• https://orc.apache.org/security/CVE-2025-47436/ advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2025/05/13/4 mailing list · advisory pihak ketiga