poi: Parsing of multiple file types can cause a denial of service via infinite loop or out of memory exception

🗓️ 03 May 2018 19:04:46Reported by RedHatType

Apache POI before 3.17 may cause denial of service from infinite loops in metafiles and macros and memory errors in Word, PowerPoint, and Excel.

Reporter	Title	Published	Views	Family All 64
Gitee	Exploit for Unrestricted Upload of File with Dangerous Type in Apache Tomcat	16 May 202116:14	–	gitee
Gitee	Exploit for Unrestricted Upload of File with Dangerous Type in Apache Tomcat	27 Apr 202114:33	–	gitee
Gitee	Exploit for Unrestricted Upload of File with Dangerous Type in Apache Tomcat	22 Oct 202115:45	–	gitee
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities Impact IBM Predictive Insights	8 Sep 202020:36	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities found in poi-3.9.jar, poi-scratchpad-3.9.jar which is shipped with IBM® Intelligent Operations Center(CVE-2017-12626, CVE-2014-9527)	5 Sep 202312:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities	13 Aug 202122:15	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Poi as used by IBMQRadar SIEM is vulnerable to information disclosure (CVE-2019-12415, CVE-2017-12626)	21 Dec 202012:38	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities found in poi-3.9.jar which is shipped with IBM® Intelligent Operations Center [CVE-2017-12626 and X-Force ID: 220800]	7 Sep 202310:42	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect embedded rules in IBM Business Automation Workflow	11 Jan 202413:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Business Intelligence has addressed multiple vulnerabilties	19 Dec 201921:01	–	ibm

Vulners

Node

AND

Node

AND

Source	Link
access	www.access.redhat.com/security/cve/CVE-2017-12626
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2017-12626
cve	www.cve.org/CVERecord

30 Jun 2026 11:42Current

7.2High risk

Vulners AI Score7.2

CVSS 25

CVSS 37.5

CVSS 3.17.5

EPSS0.10248

SSVC