Apache Orc vulnerabilities

2 CVEs affecting Apache Orc, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-47436, published 2025-05-14.

More from Apache.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-8015, published 2018-05-18. High severity, CVSS 7.5. EPSS: 3.3% chance of exploitation in the next 30 days. In Apache ORC 1.0.0 to 1.4.3 a malformed ORC file can trigger an endlessly recursive function call in the C++ or Java parser. The impact of this bug is most likely denial-of-service against software…
• CVE-2025-47436, published 2025-05-14. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Heap-based Buffer Overflow vulnerability in Apache ORC. A vulnerability has been identified in the ORC C++ LZO decompression logic, where specially crafted malformed ORC files can cause the…