A carefully crafted TNEF file can cause an out of memory exception
Priority LOW 28CWE-20Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 1 fixed, 8 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.
Summary
A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.
Why it matters now
EPSS 0.01526 74th percentileScored 2026-11-07
Fix Partial org.apache.poi:poi-scratchpad (Maven): 5.2.1Red Hat: 1 advisoryRed Hat: 1 fixed, 8 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | poi-scratchpad | up to 5.2.0 | — | No fix listed | CNA |
| — | org.apache.poi:poi-scratchpad (Maven) | 3.8-beta1 to before 5.2.1 | 5.2.1 | Patch available | GHSA-mqvp-7rrg-9jxc |
- poi-scratchpad VendorApache Affected up to 5.2.0 Fixed in — No fix listed CNA
- org.apache.poi:poi-scratchpad (Maven) Vendor— Affected 3.8-beta1 to before 5.2.1 Fixed in 5.2.1 Patch available GHSA-mqvp-7rrg-9jxc
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:poi:*:*:*:*:*:*:*:* | before 5.2.1 | Vulnerable | Apache |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:apache:poi:*:*:*:*:*:*:*:* Versions before 5.2.1 Vulnerable ·Apache
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · GHSA-mqvp-7rrg-9jxc org.apache.poi:poi-scratchpad (Maven) Fixed in 5.2.1 Advisory →
Red Hat 1 advisory
- RHSA-2022:5532 Released 2022-07-07 · Red Hat rating ImportantRed Hat Fuse 7.11.0 release and security update
- Red Hat Fuse 7.11
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Logging Subsystem for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Red Hat Integration Camel K 1 | Affected | No fix yet: Fix deferred |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat build of Quarkus | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7.11 | Fixed | RHSA-2022:5532 |
Not affected: 3 products
- Red Hat Data Grid 8
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform Expansion Pack
Timeline
- 2026-10-02 Threatist record created from CVE-2022-26336
- 2026-10-03 Alias added: GHSA-mqvp-7rrg-9jxc
References
More Apache Poi vulnerabilities
- TI-2017-09351 Infinite loop in Apache POI CVSS 3.1HIGH 7.5
- TI-2014-02855 The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary… CVSS 2.0MEDIUM 4.3
- TI-2025-22816 Improper input validation in Apache POI CVSS 3.1MEDIUM 5.3
- TI-2012-00206 The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache… CVSS 2.0MEDIUM 5.0
- TI-2017-03644 Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of… CVSS 3.0MEDIUM 5.5
- TI-2016-04320 The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary… CVSS 3.0MEDIUM 5.5
Sources
- CVE-2022-26336 · CVE Program
- CVE-2022-26336 · NVD
- FIRST EPSS
- GHSA-mqvp-7rrg-9jxc · GitHub Advisory Database · CC BY 4.0
- CVE-2022-26336 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences