CVE-2017-12626 Denial of Service in Apache POI
Attackers can cause denial of service via infinite loops or out-of-memory errors by crafting malicious Office documents parsed by Apache POI.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-12626?
CVE-2017-12626 is a high-severity denial of service vulnerability in Apache POI, published on 29 Jan 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).
Weakness: CWE-835
Which versions are affected by CVE-2017-12626?
2 open source packages ship an affected version, including org.apache.poi:poi. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.poi:poi Maven | All versions | 3.17 |
org.apache.poi:poi Maven | All versions | 3.17 |
Products include Apache Poi.
How do I fix CVE-2017-12626?
Upgrade org.apache.poi:poi to 3.17 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2017-12626 being exploited?
There is no known exploitation of CVE-2017-12626 in the wild and no public exploit code.
Other vulnerabilities in Apache POI
- CVE-2022-26336 A carefully crafted TNEF file can cause an out of memory exception
- CVE-2019-12415 Improper Restriction of XML External Entity Reference in Apache POI
- CVE-2017-5644 Improper Restriction of Recursive Entity References in DTDs in Apache POI
- CVE-2016-5000 Apache POI's XLSX2CSV Example XML External Entity (XXE) Vulnerability
- CVE-2025-31672 Apache POI OOXML Vulnerable to Improper Input Validation in OOXML File Parsing
Sources
Also known as CLSA-2026-1782435542, DEBIAN-CVE-2017-12626, GHSA-523c-xh4g-mh5m, UBUNTU-CVE-2017-12626.