Listen to this Post
How the CVE Works
The vulnerability arises due to improper input validation in Apache POI when parsing OOXML files (e.g., .xlsx, .docx, .pptx). These files are ZIP archives, and an attacker can craft a malicious file with duplicate ZIP entries (same path/filename). Different parsers may resolve these duplicates inconsistently, leading to data misinterpretation or corruption. Apache POI versions before 5.4.0 do not enforce uniqueness checks, allowing attackers to manipulate file processing. The fix in 5.4.0 introduces validation to reject such malformed ZIP entries.
DailyCVE Form
Platform: Apache POI
Version: <5.4.0
Vulnerability: Improper Input Validation
Severity: Critical
Date: 2025-04-09
Prediction: Patch expected by 2025-04-16
What Undercode Say
Analytics:
Check installed POI version java -cp poi-.jar org.apache.poi.Version Malicious file detection zipinfo -1 malicious.docx | sort | uniq -d
How Exploit
- Craft OOXML with duplicate ZIP entries.
- Trigger parsing inconsistency in target systems.
- Bypass validation via path confusion.
Protection from this CVE
- Upgrade to POI 5.4.0+.
- Validate OOXML files pre-processing.
- Reject duplicate ZIP entries.
Impact
- Data corruption.
- Arbitrary code execution (context-dependent).
- Parsing inconsistency across systems.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
