Login Request a demo
High severity · published Jan 29, 2018
CVE-2017-12626
Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and…
7.5
CVSS
10.1%
EPSS
No
On KEV
Description
Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)10.1% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
Poi · Apache
before 3.17 · source: NVD
Affected product
PO
Poi
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-12626
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-12626
Third Party Advisory
http://www.securityfocus.com/bid/102879
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1322
lists.apache.org
https://lists.apache.org/thread.html/453d9af5dbabaccd9afb58d27279a9dbfe8e35f4e5ea1645ddd6960b%40%3Cdev.poi.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E
www.oracle.com
https://www.oracle.com/security-alerts/cpuApr2021.html
www.oracle.com
https://www.oracle.com/security-alerts/cpuapr2020.html
More from Poi
5.5
CVE-2022-26336
A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception
5.5
CVE-2019-12415
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files…
5.5
CVE-2017-5644
Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion…
5.5
CVE-2016-5000
The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in…
5.3
CVE-2025-31672
Improper Input Validation vulnerability in Apache POI