CVE-2017-12626highCWE-835

CVE-2017-12626: high-severity vulnerability in Apache POI

Published · Updated

Follow this CVE+ Monitor Apache POI+ Monitor libapache-poi-java

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

26Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 10%
Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Apache Software Foundation · Apache POI
Related CVEs — Apache POI

In the same product, most dangerous first.

CVE-2017-5644—CVE-2017-5644EPSS 4.6%CVE-2025-31672MEDIUMApache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry namesEPSS 1.4%