CVE-2014-9527
Loop with Unreachable Exit Condition in Apache POI
CVE-2014-9527 is a medium vulnerability (CVSS 5.0) in Apache Poi, published January 6, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.63%, the 93rd percentile. Fixed in org.apache.poi:poi 3.11.
HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service (infinite loop and deadlock) via a crafted PPT file.
Exploit likelihood
What each source reports
NVD Score used
HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service (infinite loop and deadlock) via a crafted PPT file.
- Record
CVE-2014-9527- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service (infinite loop and deadlock) via a crafted PPT file.
- Record
CVE-2014-9527- Updated
- 2026-11-02
EUVDEUVD-2022-5754 No score
HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service (infinite loop and deadlock) via a crafted PPT file.
- Record
EUVD-2022-5754- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x9mm-6gpf-f749 No score
Loop with Unreachable Exit Condition in Apache POI
HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service (infinite loop and deadlock) via a crafted PPT file.
- Record
GHSA-x9mm-6gpf-f749- Weakness
- CWE-835
- Updated
- 2026-11-02
OSVCLSA-2026-1777941834 No score
TuxCare security update for org.apache.poi (5 CVEs)
TuxCare rebuilt 3 org.apache.poi packages to address 5 CVEs. Fixed in 3.10-FINAL-tuxcare.1.
- Record
CLSA-2026-1777941834- Updated
- 2026-11-02
OSV No score
HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service (infinite loop and deadlock) via a crafted PPT file.
- Record
CVE-2014-9527- Updated
- 2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2014-9527 No score
HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service (infinite loop and deadlock) via a crafted PPT file.
- Record
DEBIAN-CVE-2014-9527- Updated
- 2026-11-02
OSVGHSA-x9mm-6gpf-f749 No score
Loop with Unreachable Exit Condition in Apache POI
HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service (infinite loop and deadlock) via a crafted PPT file.
- Record
GHSA-x9mm-6gpf-f749- Weakness
- CWE-835
- Updated
- 2026-11-02
OSVMGASA-2015-0087 No score
Updated apache-poi packages fix CVE-2014-9527
Updated apache-poi packages fixes security vulnerability:
A denial of service flaw was found in the way the HSLFSlideShow class implementation in Apache POI handled certain PPT files. A remote attacker could submit a specially crafted PPT file that would cause Apache POI to hang indefinitely (CVE-2014-9527).
- Record
MGASA-2015-0087- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-9527 No score
HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service (infinite loop and deadlock) via a crafted PPT file.
- Record
UBUNTU-CVE-2014-9527- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.poi:poiMaven |
before 3.11 | 3.11 |
org.apache.poi:poiTuxCare:Maven |
3.10-FINAL up to 3.10-FINAL-tuxcare.1 | 3.10-FINAL-tuxcare.1 |
org.apache.poi:poi-ooxmlTuxCare:Maven |
3.10-FINAL up to 3.10-FINAL-tuxcare.1 | 3.10-FINAL-tuxcare.1 |
org.apache.poi:poi-scratchpadTuxCare:Maven |
3.10-FINAL up to 3.10-FINAL-tuxcare.1 | 3.10-FINAL-tuxcare.1 |
libapache-poi-javaDebian:12 |
before 3.10.1-2 | 3.10.1-2 |
libapache-poi-javaDebian:13 |
before 3.10.1-2 | 3.10.1-2 |
libapache-poi-javaDebian:14 |
before 3.10.1-2 | 3.10.1-2 |
org.apache.poi:poiMaven |
before 3.11, plus listed versions 3.0-FINAL3.0.1-FINAL3.0.2-FINAL3.0.2-beta13.0.2-beta2 Show 29 moreShow less3.1-FINAL3.1-beta13.1-beta23.10-FINAL3.10-beta13.10-beta23.10.13.11-beta13.11-beta23.11-beta33.2-FINAL3.5-FINAL3.5-beta13.5-beta33.5-beta43.5-beta53.5-beta63.63.73.7-beta13.7-beta23.7-beta33.83.8-beta13.8-beta23.8-beta33.8-beta43.8-beta53.9 |
3.11 |
apache-poiMageia:4 |
before 3.10.1-1.1.mga4 | 3.10.1-1.1.mga4 |
libapache-poi-javaUbuntu:16.04:LTS |
before 3.10.1-2 | 3.10.1-2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | affected | OSV |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
www-01.ibm.com/support/docview.wss?uid=swg21996759
access.redhat.com/errata/RHSA-2016:1135
poi.apache.org/changes.html
securityfocus.com/bid/77726
secunia.com/advisories/61953
lists.fedoraproject.org/pipermail/package-announce/2015-February/150228.html
Show 8 moreShow less
issues.apache.org/bugzilla/show_bug.cgi?id=57272
nvd.nist.gov/vuln/detail/CVE-2014-9527
github.com/advisories/GHSA-x9mm-6gpf-f749
security-tracker.debian.org/tracker/CVE-2014-9527
advisories.mageia.org/MGASA-2015-0087.html
bugs.mageia.org/show_bug.cgi?id=15351
ubuntu.com/security/CVE-2014-9527
cve.org/CVERecord?id=CVE-2014-9527