CVE-2024-40897

2024-07-2606:03:23

jpcert

github.com

stack-based buffer overflow

orc compiler

vulnerability

arbitrary code execution

compromise

developer machines

ci build environments

AI Score

7.7

Confidence

High

EPSS

Percentile

5.0%

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

Stack-based buffer overflow vulnerability exists in orcparse.c of ORC versions prior to 0.4.39. If a developer is tricked to process a specially crafted file with the affected ORC compiler, an arbitrary code may be executed on the developer’s build environment. This may lead to compromise of developer machines or CI build environments.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:gstreamer:orc:*:*:*:*:*:*:*:*"
    ],
    "vendor": "gstreamer",
    "product": "orc",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "0.4.39",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]