CVE-2024-40897

Name of the Vulnerable Software and Affected Versions ORC versions prior to 0.4.39

Description A stack-based buffer overflow vulnerability exists in the orcparse.c file of the ORC compiler. If a developer is tricked into processing a specially crafted file with the affected ORC compiler, arbitrary code may be executed on the developer's build environment. This could lead to the compromise of developer machines or CI build environments.

Recommendations For ORC versions prior to 0.4.39, update to version 0.4.39 or later to resolve the issue. As a temporary workaround, consider restricting the use of the affected ORC compiler until a patch is available. Avoid processing specially crafted files with the affected ORC compiler to minimize the risk of exploitation.