Medium severity · published Mar 4, 2022
CVE-2022-26336
A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception
5.5
CVSS
1.5%
EPSS
No
On KEV
Description
A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Active IQ Unified Manager · Netapp
All versions, or not specified · source: NVD
PO
Poi · Apache
before 5.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-26336
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-26336
Mailing List
https://lists.apache.org/thread/sprg0kq986pc2271dc3v2oxb1f9qx09j
Third Party Advisory
https://security.netapp.com/advisory/ntap-20221028-0006/
More from Poi
7.5
CVE-2017-12626
Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and…
5.5
CVE-2019-12415
In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files…
5.5
CVE-2017-5644
Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion…
5.5
CVE-2016-5000
The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in…
5.3
CVE-2025-31672
Improper Input Validation vulnerability in Apache POI