CVE-2025-33042
Awaiting Analysis Awaiting Analysis - Queue
Code Injection in Apache Avro Java SDK Allows Malicious Code Execution

Publication date: 2026-02-13

Last updated on: 2026-02-20

Assigner: Apache Software Foundation

Description
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0. Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-13
Last Modified
2026-02-20
Generated
2026-06-16
AI Q&A
2026-02-13
EPSS Evaluated
2026-06-15
NVD
CVE-2025-33042
EUVD
EUVD-2025-206910
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
apache avro to 1.11.5 (exc)
apache avro 1.12.0
apache avro 1.12.0
apache avro 1.12.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an Improper Control of Generation of Code, also known as a 'Code Injection' vulnerability, found in the Apache Avro Java SDK. It occurs when generating specific records from untrusted Avro schemas, which can lead to unsafe code execution.

Impact Analysis

The vulnerability can allow attackers to inject malicious code through untrusted Avro schemas, potentially leading to unauthorized code execution within applications using the affected Apache Avro Java SDK versions.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, users are recommended to upgrade the Apache Avro Java SDK to version 1.12.1 or 1.11.5, which contain fixes for the issue.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-33042. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart