CVE-2024-40897

Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39

High · published July 26, 2024

CVSS v3.1
7.0
EPSS
0%
Percentile
30.7
In the wild
Unconfirmed
What it is

Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer's build environment. This may lead to compromise of developer machines or CI build environments.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00379 · 30.7th percentile
Published
2024-07-26T06:03Z
EPSS history
Timeline
  • 26 JUL 06:03Z
    Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39
    cvelistv5