Every CVE Search/ Get API key

CVE-2017-12626

Denial of Service in Apache POI

7.5 HighFix available

CVE-2017-12626 is a high vulnerability (CVSS 7.5) in Apache Poi, published January 29, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 10.1%, the 95th percentile. Fixed in org.apache.poi:poi 3.17.

Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

10.1%Up 2.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List 7.5

Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).

Record
CVE-2017-12626
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-835
Updated
2026-11-02
EUVDEUVD-2021-0489 7.5

Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).

Record
EUVD-2021-0489
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-523c-xh4g-mh5m 7.5

Denial of Service in Apache POI

Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks:

  • Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294)
  • Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295)
Record
GHSA-523c-xh4g-mh5m
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-835
Updated
2026-11-02
NVD 7.5

Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).

Record
CVE-2017-12626
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-835
Updated
2026-11-02
OSV 7.5

Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).

Record
CVE-2017-12626
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2017-12626 7.5

Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).

Record
DEBIAN-CVE-2017-12626
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-523c-xh4g-mh5m 7.5

Denial of Service in Apache POI

Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks:

  • Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294)
  • Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295)
Record
GHSA-523c-xh4g-mh5m
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-835
Updated
2026-11-02
OSVUBUNTU-CVE-2017-12626 7.5

Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).

Record
UBUNTU-CVE-2017-12626
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVCLSA-2026-1782435542 No score

TuxCare security update for org.apache.poi:poi (1 CVE)

TuxCare rebuilt org.apache.poi:poi to address 1 CVE. Fixed in 3.10-FINAL-tuxcare.3.

Record
CLSA-2026-1782435542
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.poi:poi
Maven
 before 3.17
3.17
org.apache.poi:poi
TuxCare:Maven
 3.10-FINAL up to 3.10-FINAL-tuxcare.3, plus listed versions
3.10-FINAL-tuxcare.13.10-FINAL-tuxcare.2
3.10-FINAL-tuxcare.3
libapache-poi-java
Debian:12
 before 3.17-1
3.17-1
libapache-poi-java
Debian:13
 before 3.17-1
3.17-1
libapache-poi-java
Debian:14
 before 3.17-1
3.17-1
org.apache.poi:poi
Maven
 before 3.17, plus listed versions
3.0-FINAL3.0.1-FINAL3.0.2-FINAL3.0.2-beta13.0.2-beta2
Show 43 moreShow less
3.1-FINAL3.1-beta13.1-beta23.10-FINAL3.10-beta13.10-beta23.10.13.113.11-beta13.11-beta23.11-beta33.123.12-beta13.133.13-beta13.143.14-beta13.153.15-beta13.15-beta23.163.16-beta13.16-beta23.17-beta13.2-FINAL3.5-FINAL3.5-beta13.5-beta33.5-beta43.5-beta53.5-beta63.63.73.7-beta13.7-beta23.7-beta33.83.8-beta13.8-beta23.8-beta33.8-beta43.8-beta53.9
3.17
libapache-poi-java
Ubuntu:16.04:LTS
 All versions, plus listed versions
3.10.1-2
 None known
libapache-poi-java
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.10.1-34.0.1-1~18.03
 None known

History

History
WhenChangedSources
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD, OSV

References

Show 17 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open