CVE-2022-26336
A carefully crafted TNEF file can cause an out of memory exception
A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.
- Record
CVE-2022-26336- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-20, CWE-770
- Updated
- 2026-11-02
CVE List No score
A carefully crafted TNEF file can cause an out of memory exception
A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.
- Record
CVE-2022-26336- Weakness
- CWE-770, CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2022-1484 No score
A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.
- Record
EUVD-2022-1484- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mqvp-7rrg-9jxc
Improper Input Validation and Allocation of Resources Without Limits or Throttling in poi-scratchpad
A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.
- Record
GHSA-mqvp-7rrg-9jxc- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-770
- Updated
- 2026-11-02
OSVGHSA-mqvp-7rrg-9jxc
Improper Input Validation and Allocation of Resources Without Limits or Throttling in poi-scratchpad
A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.
- Record
GHSA-mqvp-7rrg-9jxc- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-20, CWE-770
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-26336
A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.
- Record
UBUNTU-CVE-2022-26336- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1777941834 No score
TuxCare security update for org.apache.poi (5 CVEs)
TuxCare rebuilt 3 org.apache.poi packages to address 5 CVEs. Fixed in 3.10-FINAL-tuxcare.1.
- Record
CLSA-2026-1777941834- Updated
- 2026-11-02
OSVCLSA-2026-1780534250 No score
TuxCare security update for org.apache.poi:poi-scratchpad (1 CVE)
TuxCare rebuilt org.apache.poi:poi-scratchpad to address 1 CVE. Fixed in 4.1.2-tuxcare.3.
- Record
CLSA-2026-1780534250- Updated
- 2026-11-02
OSV No score
A carefully crafted TNEF file can cause an out of memory exception
A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.
- Record
CVE-2022-26336- Weakness
- CWE-20, CWE-770
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.poi:poi-scratchpadMaven |
3.8-beta1 up to 5.2.1 | 5.2.1 |
org.apache.poi:poiTuxCare:Maven From an advisory covering 5 CVEs |
3.10-FINAL up to 3.10-FINAL-tuxcare.1 | 3.10-FINAL-tuxcare.1 |
org.apache.poi:poi-ooxmlTuxCare:Maven From an advisory covering 5 CVEs |
3.10-FINAL up to 3.10-FINAL-tuxcare.1 | 3.10-FINAL-tuxcare.1 |
org.apache.poi:poi-scratchpadTuxCare:Maven From an advisory covering 5 CVEs |
3.10-FINAL up to 3.10-FINAL-tuxcare.1 | 3.10-FINAL-tuxcare.1 |
org.apache.poi:poi-scratchpadTuxCare:Maven |
4.1.2 up to 4.1.2-tuxcare.3, plus listed versions 4.1.2-tuxcare.14.1.2-tuxcare.2 |
4.1.2-tuxcare.3 |
org.apache.poi:poi-scratchpadMaven |
3.8-beta1 up to 5.2.1, plus listed versions 3.10-FINAL3.10-beta13.10-beta23.10.13.11 Show 31 moreShow less3.11-beta13.11-beta23.11-beta33.123.12-beta13.133.13-beta13.143.14-beta13.153.15-beta13.15-beta23.163.16-beta13.16-beta23.173.17-beta13.83.8-beta23.8-beta33.8-beta43.8-beta53.94.0.04.0.14.1.04.1.14.1.25.0.05.1.05.2.0 |
5.2.1 |
lucene-solrUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 3.6.2+dfsg-13.6.2+dfsg-23.6.2+dfsg-2ubuntu0.1~esm13.6.2+dfsg-2ubuntu0.1~esm23.6.2+dfsg-2ubuntu0.1~esm4 |
None known |
libapache-poi-javaUbuntu:16.04:LTS |
All versions, plus listed versions 3.10.1-2 |
None known |
lucene-solrUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.6.2+dfsg-73.6.2+dfsg-83.6.2+dfsg-8ubuntu0.13.6.2+dfsg-8ubuntu0.1+esm1 |
None known |
libapache-poi-javaUbuntu:18.04:LTS |
All versions, plus listed versions 3.10.1-34.0.1-1~18.03 |
None known |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
lucene-solrUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.6.2+dfsg-103.6.2+dfsg-113.6.2+dfsg-18~18.043.6.2+dfsg-18~18.04.1~esm2 |
None known |
libapache-poi-javaUbuntu:20.04:LTS |
All versions, plus listed versions 4.0.1-1 |
None known |
lucene-solrUbuntu:20.04:LTS |
All versions, plus listed versions 3.6.2+dfsg-203.6.2+dfsg-22 |
None known |
libapache-poi-javaUbuntu:22.04:LTS |
All versions, plus listed versions 4.0.1-14.0.1-24.0.1-3 |
None known |
lucene-solrUbuntu:22.04:LTS |
All versions, plus listed versions 3.6.2+dfsg-24 |
None known |
libapache-poi-javaUbuntu:24.04:LTS |
All versions, plus listed versions 4.0.1-44.0.1-54.0.1-6 |
None known |
lucene-solrUbuntu:24.04:LTS |
All versions, plus listed versions 3.6.2+dfsg-26 |
None known |
libapache-poi-javaUbuntu:25.10 |
All versions, plus listed versions 4.0.1-6 |
None known |
lucene-solrUbuntu:25.10 |
All versions, plus listed versions 3.6.2+dfsg-26 |
None known |
libapache-poi-javaUbuntu:26.10 |
All versions, plus listed versions 4.0.1-6 |
None known |
lucene-solrUbuntu:26.10 |
All versions, plus listed versions 3.6.2+dfsg-27 |
None known |
libapache-poi-javaUbuntu:26.04:LTS |
All versions, plus listed versions 4.0.1-6 |
None known |
lucene-solrUbuntu:26.04:LTS |
All versions, plus listed versions 3.6.2+dfsg-263.6.2+dfsg-27 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-26336 is a medium vulnerability (CVSS 5.5) in Apache Poi, published March 4, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.53%, the 74th percentile. Fixed in org.apache.poi:poi-scratchpad 5.2.1.
References
lists.apache.org/thread/sprg0kq986pc2271dc3v2oxb1f9qx09j
security.netapp.com/advisory/ntap-20221028-0006
nvd.nist.gov/vuln/detail/CVE-2022-26336
github.com/advisories/GHSA-mqvp-7rrg-9jxc
ubuntu.com/security/CVE-2022-26336
cve.org/CVERecord?id=CVE-2022-26336