CVE-2017-12626

poi: Parsing of multiple file types can cause a denial of service via infinite loop or out of memory exception

Loading…

Severity

Moderate

Red Hat Product Security

5.3

CVSS 3.0

Review impact separately from score.

Published · January 26, 2018

Updated · May 29, 2026

Description

Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.0 · 5.3
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')