CVE-2025-31672

The Apache POI library's poi-ooxml component (versions before 5.4.0 ) is vulnerable to an Improper Input Validation issue (CWE-20 ) when parsing OOXML files (e.g., xlsx , docx , pptx ). Malicious users can include zip entries with duplicate names , causing different products to potentially read d...

CVE-2017-12626

CVE-2017-12626 affects Apache POI prior to 3.17. The vulnerability arises from parsing crafted WMF/EMF/MSG and macros (leading to denial of service via infinite loop) and crafted DOC/PPT/XLS (leading to out-of-memory errors). Multiple connected advisories reference this CVE and describe it as a D...

CVE-2022-26336

CVE-2022-26336 affects the poi-scratchpad HMEF package in Apache POI used to read TNEF files. The issue can trigger an Out of Memory exception when parsing untrusted TNEF inputs, impacting poi-scratchpad versions up to 5.2.0. The publicly recommended remediation is to upgrade to poi-scratchpad 5....