Listen to this Post
How the CVE Works
The CVE-2025-47436 vulnerability exists in Apache ORC’s C++ LZO decompression logic. When processing a specially crafted ORC file, the decompressor allocates a 250-byte buffer but attempts to write 295 bytes into it. This heap-based buffer overflow leads to memory corruption, potentially allowing arbitrary code execution or application crashes. The issue stems from improper bounds checking during LZO decompression, where the input size validation is insufficient. Attackers exploiting this flaw could manipulate ORC files to trigger the overflow, compromising system stability or executing malicious payloads.
DailyCVE Form
Platform: Apache ORC
Version: <=1.8.8, 1.9.0-1.9.5, 2.0.0-2.0.4, 2.1.0-2.1.1
Vulnerability: Heap overflow
Severity: MEDIUM
Date: 07/14/2025
Prediction: Patch by 08/2025
What Undercode Say
Check ORC version orc-metadata --version Fuzzing test (PoC) python3 generate_malformed_orc.py --lzo --overflow Debug with Valgrind valgrind --tool=memcheck orc-metadata exploit.orc
How Exploit
- Craft malicious ORC file
- Trigger LZO decompression
- Overflow heap buffer
- Corrupt adjacent memory
Protection from this CVE
- Upgrade to 1.8.9/1.9.6/2.0.5/2.1.2
- Disable LZO compression
- Validate ORC files
Impact
- Memory corruption
- Possible RCE
- Denial-of-service
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
