CVE-2022-26336CWE-20CWE-770

A carefully crafted TNEF file can cause an out of memory exception

published March 4, 2022

CVSS
—
EPSS
2%
Percentile
74.5
In the wild
Unconfirmed
What it is

A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01526 · 74.5th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2022-03-04T00:00Z
EPSS history
Timeline
  • 04 MAR 00:00Z
    A carefully crafted TNEF file can cause an out of memory exception
    cvelistv5