Skip to content
Fencer Vulns
medium 5.5

CVE-2022-26336 json

A carefully crafted TNEF file can cause an out of memory exception

published 2022-03-04 4 y ago modified 2026-06-17 4 mo ago also GHSA-mqvp-7rrg-9jxc , EUVD-2022-1484

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits
0
none known

Summary

A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.

Patch / fix

  • maven org.apache.poi:poi-scratchpad 5.2.1
  • apache poi 5.2.1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-26336 updated cvss 3.5

poi-scratchpad: A carefully crafted TNEF file can cause an out of memory exception

  • Red Hat Logging Subsystem for Red Hat OpenShift poi-scratchpad Red Hat build of Quarkus poi-scratchpad poi-scratchpad Red Hat Integration Camel K 1 poi-scratchpad poi-scratchpad Red Hat Integration Camel Quarkus 1 poi-scratchpad poi-scratchpad
    affected: no fix available “Fix deferred”
  • Red Hat JBoss Data Grid 7 poi-scratchpad poi-scratchpad Red Hat JBoss Data Virtualization 6 poi-scratchpad poi-scratchpad Red Hat JBoss Fuse 6 poi-scratchpad poi-scratchpad Red Hat JBoss Fuse Service Works 6 poi-scratchpad poi-scratchpad
    affected: no fix planned “Out of support scope”
  • Red Hat Fuse 7.11
    fixed: vendor fix RHSA-2022:5532
  • Red Hat Data Grid 8 poi-scratchpad poi-scratchpad Red Hat JBoss Enterprise Application Platform 7 poi-scratchpad poi-scratchpad Red Hat JBoss Enterprise Application Platform Expansion Pack poi-scratchpad poi-scratchpad
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.53% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P
GitHub 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven org.apache.poi:poi-scratchpad
>=3.8-beta1, <5.2.1
5.2.1

Affected products

  • Apache Software Foundation poi-scratchpad

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.