Vulnerability · Published Mar 4, 2022 · Assigned by apache
CVE-2022-26336A carefully crafted TNEF file can cause an out of memory exception
Medium 5.5
In plain English
A medium-severity resource allocation without limits in poi-scratchpad from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.poi:poi-scratchpad | 5.2.1 | GHSA-mqvp-7rrg-9jxc |
| Ubuntu:22.04:LTS | libapache-poi-java | no fix listed | UBUNTU-CVE-2022-26336 |
| Ubuntu:24.04:LTS | libapache-poi-java | no fix listed | UBUNTU-CVE-2022-26336 |
| Ubuntu:25.10 | libapache-poi-java | no fix listed | UBUNTU-CVE-2022-26336 |
| Ubuntu:26.04:LTS | libapache-poi-java | no fix listed | UBUNTU-CVE-2022-26336 |
| Ubuntu:26.10 | libapache-poi-java | no fix listed | UBUNTU-CVE-2022-26336 |
| Ubuntu:22.04:LTS | lucene-solr | no fix listed | UBUNTU-CVE-2022-26336 |
| Ubuntu:24.04:LTS | lucene-solr | no fix listed | UBUNTU-CVE-2022-26336 |
| Ubuntu:25.10 | lucene-solr | no fix listed | UBUNTU-CVE-2022-26336 |
| Ubuntu:26.04:LTS | lucene-solr | no fix listed | UBUNTU-CVE-2022-26336 |
| Ubuntu:26.10 | lucene-solr | no fix listed | UBUNTU-CVE-2022-26336 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | poi-scratchpad | unspecified – through 5.2.0 |
Weakness: CWE-770, CWE-20