CVE-2025-33042

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.

This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.

Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Avro Java SDK	<= 1.11.4; 1.12.0

References

https://lists.apache.org/thread/fy88wmgf1lj9479vrpt12cv8x73lroj1Issue Tracking, Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/02/12/2Mailing List, Third Party Advisory

Timeline

Published: Feb 13, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-330436.1APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation locally. Successful exploitation of this vu CVE-2025-330447.8APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Restriction of Operations within the Bounds of a Memory Buff CVE-2025-330456.7APTIOV contains vulnerabilities in the BIOS where a privileged user may cause “Write-what-where Condition” and “Exposure of Sensitive Inform CVE-2025-33054.3A vulnerability has been found in 1902756969/code-projects IKUN_Library 1.0 and classified as problematic. This vulnerability affects the fu CVE-2025-330507.5Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network.CVE-2025-330517.5Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose informat CVE-2025-330525.5Use of uninitialized resource in Windows DWM Core Library allows an authorized attacker to disclose information locally.CVE-2025-330538.8External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.CVE-2025-330548.1Insufficient UI warning of dangerous operations in Remote Desktop Client allows an unauthorized attacker to perform spoofing over a network.CVE-2025-330555.5Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally.CVE-2025-330567.5Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an unauthorized attacker to deny service over a network CVE-2025-330576.5Null pointer dereference in Windows Local Security Authority (LSA) allows an authorized attacker to deny service over a network.