CVE-2025-47436 | Apache ORC up to 1.8.8/1.9.5/2.0.4/2.1.1 C++ LZO Decompression heap-based overflow

A vulnerability was found in Apache ORC up to 1.8.8/1.9.5/2.0.4/2.1.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component C++ LZO Decompression. The manipulation leads to heap-based buffer overflow.

This vulnerability is known as CVE-2025-47436. Access to the local network is required for this attack. There is no exploit available.

It is recommended to upgrade the affected component.