CVE-2022-26336: A carefully crafted TNEF file can cause an out of memory exception
A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.poi:poi-scratchpadto a version that resolves this vulnerability.Fixed in 5.2.1 - Compensating control
If you cannot immediately upgrade, avoid parsing TNEF files from untrusted users or sources. Restrict or block acceptance of TNEF/RFC HMEF inputs from untrusted origins, or validate/sandbox TNEF parsing to mitigate potential out-of-memory conditions.
Event History
Frequently Asked Questions
What is CVE-2022-26336?
CVE-2022-26336 is a vulnerability in the HMEF package of poi-scratchpad (Apache POI) that allows an attacker to cause an Out of Memory exception by parsing TNEF files.
What software is affected by CVE-2022-26336?
Apache POI (up to version 5.2.1), Netapp Active IQ Unified Manager, Apple iPadOS, and Apple watchOS are affected by CVE-2022-26336.
How severe is CVE-2022-26336?
CVE-2022-26336 has a severity rating of 5.5 (Medium).
How can an attacker exploit CVE-2022-26336?
An attacker can exploit CVE-2022-26336 by providing a specially crafted TNEF file to an application that uses poi-scratchpad to parse TNEF files, causing an Out of Memory exception.
Is there a fix available for CVE-2022-26336?
Yes, users should update to a version of Apache POI beyond 5.2.1 to mitigate the vulnerability.