---
license: apache-2.0
tags:
- security
- coordinated-disclosure
---

# Avro enum out-of-range PoC (coordinated disclosure)

Proof-of-concept artifact for a coordinated vulnerability disclosure against the
Apache Avro C library (`apache/avro`, `lang/c`, release-1.12.0).

`enum_repro.avro` is a 117-byte Avro Object Container File. Its declared schema
is an enum with symbols `["A","B"]` (valid indices 0 and 1); the single encoded
value uses enum index 100, which is out of range. Loading and rendering this file
with the reference `avrocat` tool triggers an uninitialized-pointer read (crash)
in `avro_schema_enum_get`.

This artifact is provided under coordinated disclosure and is gated; access is
restricted to the disclosure platform's review bot.