CVEvulnerability

CVE-2022-26336

5.5 MEDIUM Published 2022-03-04 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-03-04
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:N/A:P
Weaknesses
CWE-20, CWE-770

Description

A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.

Affected configurations

• apache poi (< 5.2.1) • netapp active iq unified manager

Related

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References