https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T21:21:28.633864+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-47436 CVE-2025-47436 — Apache ORC: Potential Heap Buffer Overflow during C++ LZO Decompression 2026-10-10T21:21:28.657747+00:00

Affected: Apache Software Foundation Apache ORC

Heap-based Buffer Overflow vulnerability in Apache ORC.

A vulnerability has been identified in the ORC C++ LZO decompression logic, where specially crafted malformed ORC files can cause the decompressor to allocate a 250-byte buffer but then attempts to copy 295 bytes into it. It causes memory corruption.

This issue affects Apache ORC C++ library: through 1.8.8, from 1.9.0 through 1.9.5, from 2.0.0 through 2.0.4, from 2.1.0 through 2.1.1.

Users are recommended to upgrade to version 1.8.9, 1.9.6, 2.0.5, and 2.1.2, which fix the issue.