Buffer Overflow in Apache ORC Affects Multiple Versions

CVE-2025-47436

What is CVE-2025-47436?

A heap-based buffer overflow vulnerability exists in the Apache ORC C++ library's LZO decompression logic. The flaw allows specially crafted malformed ORC files to trigger a memory corruption issue when an attempt is made to copy more data than the allocated buffer can handle, leading to potential security risks. It is critical for users to upgrade to the fixed versions to mitigate these vulnerabilities.

References