Medium
Apache ORC: Potential Heap Buffer Overflow during C++ LZO Decompression
Type: advisorySources: OSV
Heap-based Buffer Overflow vulnerability in Apache ORC. A vulnerability has been identified in the ORC C++ LZO decompression logic, where specially crafted malformed ORC files can cause the decompressor to allocate a 250-byte buffer but then attempts to copy 295 bytes into it. It causes memory corruption. This issue affects Apache ORC C++ library: through 1.8.8, from 1.9.0 through 1.9.5, from 2.0.0 through 2.0.4, from 2.1.0 through 2.1.1. Users are recommended to upgrade to version 1.8.9, 1.9.6, 2.0.5, and 2.1.2, which fix the issue.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-47436
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 07:52 UTC · Revision 1
Source evidence
Apache ORC: Potential Heap Buffer Overflow during C++ LZO Decompression
core-osv · Original sourcePublished 14 May 2025, 13:11 UTC
Heap-based Buffer Overflow vulnerability in Apache ORC. A vulnerability has been identified in the ORC C++ LZO decompression logic, where specially crafted malformed ORC files can cause the decompressor to allocate a 250-byte buffer but then attempts to copy 295 bytes into it. It causes memory corruption. This issue affects Apache ORC C++ library: through 1.8.8, from 1.9.0 through 1.9.5, from 2.0.0 through 2.0.4, from 2.1.0 through 2.1.1. Users are recommended to upgrade to version 1.8.9, 1.9.6, 2.0.5, and 2.1.2, which fix the issue.
osv:CVE-2025-47436
Complete source record
{
"id": "e791f26639978ba9fcd59235c561168c4a4a8ffa4bd6f2fe270e771bddd10480",
"url": "https://osv.dev/vulnerability/CVE-2025-47436",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Apache ORC: Potential Heap Buffer Overflow during C++ LZO Decompression",
"summary": "Heap-based Buffer Overflow vulnerability in Apache ORC. A vulnerability has been identified in the ORC C++ LZO decompression logic, where specially crafted malformed ORC files can cause the decompressor to allocate a 250-byte buffer but then attempts to copy 295 bytes into it. It causes memory corruption. This issue affects Apache ORC C++ library: through 1.8.8, from 1.9.0 through 1.9.5, from 2.0.0 through 2.0.4, from 2.1.0 through 2.1.1. Users are recommended to upgrade to version 1.8.9, 1.9.6, 2.0.5, and 2.1.2, which fix the issue.",
"evidence": "osv:CVE-2025-47436",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2025-47436",
"aliases": [
"CVE-2025-47436"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/S:N/RE:M/U:Amber"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/apache/orc",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "78f3ed1d2a1adf2497a7d0f8fb866915b25f1e9e"
},
{
"introduced": "9d434392e46252bf6ad2a6414527d2e619f858e6"
},
{
"fixed": "c1323aa478fa1a273f2dd4746c3cd23868616ea4"
},
{
"introduced": "46eb6ff46c25a3c8763f8661dc5525bbe6a26550"
},
{
"fixed": "a5988e6a07ea0343aed7be6d5a568d76cf9db432"
},
{
"introduced": "2cb13946b71140be08b54111ff36fc17da5f09af"
},
{
"fixed": "e955e2bb5a0c3c9a0bb24a9039405ecea1878444"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:orc:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.8.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:orc:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.9.0"
},
{
"fixed": "1.9.6"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:orc:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:orc:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.1.0"
},
{
"fixed": "2.1.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v2.0.4-rc0",
"v2.0.4",
"rel/release-2.0.4",
"v2.1.1-rc0",
"v2.1.1",
"rel/release-2.1.1",
"v2.1.0-rc0",
"v2.1.0",
"rel/release-2.1.0",
"v2.0.3-rc0",
"v2.0.3",
"rel/release-2.0.3",
"v1.9.5-rc0",
"v1.9.5",
"rel/release-1.9.5",
"v1.8.8-rc0",
"v1.8.8",
"rel/release-1.8.8",
"v2.0.2-rc0",
"v2.0.2",
"rel/release-2.0.2",
"v1.9.4-rc0",
"v1.9.4",
"rel/release-1.9.4",
"v2.0.1-rc0",
"v2.0.1",
"rel/release-2.0.1",
"v1.8.7-rc0",
"v1.8.7",
"rel/release-1.8.7",
"v1.9.3-rc0",
"v1.9.3",
"rel/release-1.9.3",
"v2.0.0-rc0",
"v2.0.0",
"rel/release-2.0.0",
"v1.8.6-rc0",
"v1.8.6",
"rel/release-1.8.6",
"v1.9.2-rc0",
"v1.9.2",
"rel/release-1.9.2",
"v1.8.5-rc0",
"v1.8.5",
"rel/release-1.8.5",
"v1.9.1-rc0",
"v1.9.1",
"rel/release-1.9.1",
"v1.9.0-rc0",
"v1.9.0",
"rel/release-1.9.0",
"v1.8.4-rc0",
"v1.8.4",
"rel/release-1.8.4",
"v1.8.3-rc0",
"v1.8.3",
"rel/release-1.8.3",
"v1.8.2-rc0",
"v1.8.2",
"rel/release-1.8.2",
"v1.8.1-rc0",
"v1.8.1",
"rel/release-1.8.1",
"v1.8.0-rc0",
"v1.8.0",
"rel/release-1.8.0",
"rel/release-1.2.0",
"rel/release-1.1.0",
"rel/release-1.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-47436.json"
}
}
],
"modified": "2026-10-28T02:30:26.878158560Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47436.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-47436",
"https://orc.apache.org/security/CVE-2025-47436/",
"https://lists.apache.org/thread/kd6tlv8fs5jybmsgxr4vrkdxyc866wrn"
],
"provider_metadata": {
"cwe_ids": [
"CWE-122"
],
"cna_assigner": "apache",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"last_affected": "1.8.8"
},
{
"introduced": "1.9.0"
},
{
"last_affected": "1.9.5"
},
{
"introduced": "2.0.0"
},
{
"last_affected": "2.0.4"
},
{
"introduced": "2.1.0"
},
{
"last_affected": "2.1.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47436.json"
}
},
"related_cves": [
{
"value": "CVE-2025-47436",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 493551,
"published_at": "2025-05-14T13:11:36.329+00:00"
}