CVE-2012-0213

Denial of Service in Apache POI

5.0 MediumFix available

The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache POI 3.8 and earlier allows remote attackers to cause a denial of service (OutOfMemoryError exception and possibly JVM destabilization) via a crafted length value in a Channel Definition Format (CDF) or Compound File Binary Format (CFBF) document.

Exploit likelihood

7.50%Up 3.8 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

Record: CVE-2012-0213
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-399
Updated: 2026-11-02

CVE List No score

Record: CVE-2012-0213
Updated: 2026-11-02

EUVDEUVD-2022-4420 No score

Record: EUVD-2022-4420
Updated: 2026-11-03

GitHub AdvisoriesGHSA-jqx5-h2hw-5q4f No score

Denial of Service in Apache POI

Record: GHSA-jqx5-h2hw-5q4f
Weakness: CWE-400
Updated: 2026-11-02

OSVGHSA-jqx5-h2hw-5q4f No score

Denial of Service in Apache POI

Record: GHSA-jqx5-h2hw-5q4f
Weakness: CWE-400
Updated: 2026-11-02

Affected products

apache poi

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.poi:poi` Maven	before 3.10-beta1	3.10-beta1
`org.apache.poi:poi-scratchpad` Maven	before 3.10-beta1	3.10-beta1
`libjakarta-poi-java` Debian:6.0	before 3.6+dfsg-1+squeeze1, plus listed versions 3.6+dfsg-1	3.6+dfsg-1+squeeze1
`org.apache.poi:poi` Maven	before 3.10-beta1, plus listed versions 3.0-FINAL3.0.1-FINAL3.0.2-FINAL3.0.2-beta13.0.2-beta2 Show 22 moreShow less 3.1-FINAL3.1-beta13.1-beta23.2-FINAL3.5-FINAL3.5-beta13.5-beta33.5-beta43.5-beta53.5-beta63.63.73.7-beta13.7-beta23.7-beta33.83.8-beta13.8-beta23.8-beta33.8-beta43.8-beta53.9	3.10-beta1
`org.apache.poi:poi-scratchpad` Maven	before 3.10-beta1, plus listed versions 3.0.1-FINAL3.0.2-FINAL3.0.2-beta13.0.2-beta23.1-FINAL Show 21 moreShow less 3.1-beta13.1-beta23.2-FINAL3.5-FINAL3.5-beta13.5-beta33.5-beta43.5-beta53.5-beta63.63.73.7-beta13.7-beta23.7-beta33.83.8-beta13.8-beta23.8-beta33.8-beta43.8-beta53.9	3.10-beta1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-0213 is a medium vulnerability (CVSS 5.0) in Apache Poi, published May 9, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.50%, the 94th percentile. Fixed in org.apache.poi:poi 3.10-beta1.

References

Show 8 moreShow less