Cyber Resilience

CVE-2025-33042

High

Published: 13 February 2026

Published
13 February 2026
Modified
20 February 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0006 18.3th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-33042 is a high-severity Code Injection (CWE-94) vulnerability in Apache Avro. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-33042 is an Improper Control of Generation of Code ('Code Injection') vulnerability, classified under CWE-94, in the Apache Avro Java SDK. It occurs when generating specific records from untrusted Avro schemas. The issue affects all versions of the Apache Avro Java SDK through 1.11.4 and version 1.12.0. The vulnerability has a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its network accessibility and low attack complexity.

Remote attackers require no privileges or user interaction to exploit this vulnerability over the network. Successful exploitation allows limited impacts on confidentiality, integrity, and availability through code injection, potentially enabling arbitrary code execution in the context of the affected application processing untrusted schemas.

Apache advisories recommend upgrading to remedied versions 1.12.1 or 1.11.5 to mitigate the issue. Additional details are available in the Apache mailing list announcement at https://lists.apache.org/thread/fy88wmgf1lj9479vrpt12cv8x73lroj1 and the OSS-Security mailing list at http://www.openwall.com/lists/oss-security/2026/02/12/2.

EU & UK References

Vulnerability details

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0. Users are recommended to…

more

upgrade to version 1.12.1 or 1.11.5, which fix the issue.

CWE(s)
CWE-94

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Remote unauthenticated code injection in a network-accessible library directly maps to exploitation of public-facing applications for code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-54466Same vendor: Apache
CVE-2026-35194Same vendor: Apache
CVE-2025-59059Same vendor: Apache
CVE-2026-40563Same vendor: Apache
CVE-2025-54550Same vendor: Apache
CVE-2024-56373Same vendor: Apache
CVE-2024-51941Same vendor: Apache
CVE-2026-45505Same vendor: Apache
CVE-2026-40466Same vendor: Apache
CVE-2026-46586Same vendor: Apache

Affected Assets

apache
avro
1.12.0 · ≤ 1.11.5

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation and sanitization of untrusted Avro schema input before record generation, blocking the code-injection path at its source.

SI-2 Flaw Remediation good match
prevent

Mandates prompt application of vendor patches, directly addressed by upgrading Avro Java SDK to the fixed 1.11.5/1.12.1 releases.

SI-7 Software, Firmware, and Information Integrity partial match
preventdetect

Requires integrity verification of generated code/objects, enabling detection or blocking of unauthorized code produced from malicious schemas.

References