High severity7.5NVD Advisory· Published Jan 29, 2018· Updated Jun 17, 2026
CVE-2017-12626
CVE-2017-12626
Description
Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.poi:poiMaven | < 3.17 | 3.17 |
Affected products
3Patches
Vulnerability mechanics
References
15- www.securityfocus.com/bid/102879nvdThird Party AdvisoryVDB EntryWEB
- access.redhat.com/errata/RHSA-2018:1322nvdThird Party AdvisoryWEB
- github.com/advisories/GHSA-523c-xh4g-mh5mghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2017-12626ghsaADVISORY
- lists.apache.org/thread.html/453d9af5dbabaccd9afb58d27279a9dbfe8e35f4e5ea1645ddd6960b%40%3Cdev.poi.apache.org%3EnvdWEB
- lists.apache.org/thread.html/453d9af5dbabaccd9afb58d27279a9dbfe8e35f4e5ea1645ddd6960b@%3Cdev.poi.apache.org%3EghsaWEB
- lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3EnvdWEB
- lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3EghsaWEB
- www.oracle.com/security-alerts/cpuApr2021.htmlnvdWEB
- www.oracle.com/security-alerts/cpuapr2020.htmlnvdWEB
- www.oracle.com/security-alerts/cpujan2020.htmlnvdWEB
- www.oracle.com/security-alerts/cpujan2021.htmlnvdWEB
- www.oracle.com/security-alerts/cpujul2020.htmlnvdWEB
- www.oracle.com/security-alerts/cpuoct2020.htmlnvdWEB
- www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlnvdWEB
News mentions
0No linked articles in our index yet.