#VU112257 Input validation error in Apache POI - CVE-2025-31672

Vulnerability identifier: #VU112257

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-31672

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Apache POI
Server applications / Other server solutions

Vendor: Apache Foundation

Description

The vulnerability allows a remote attacker to manipulate file parsing behavior.

The vulnerability stems from the way Apache POI handles zip entries in OOXML format files. When duplicate file names (including paths) exist within the zip structure, different products may select different zip entries with the same name, leading to inconsistent data interpretation. A remote attacker can manipulate file parsing behavior through specially crafted OOXML files containing ZIP entries with duplicate file names. This manipulation can result in inconsistent data processing across different systems, potentially leading to security issues and data integrity concerns.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Apache POI: 0.1 - 5.3.1

---

External links
https://www.openwall.com/lists/oss-security/2025/04/08/2
https://bz.apache.org/bugzilla/show_bug.cgi?id=69620
https://lists.apache.org/thread/k14w8vcjqy4h34hh5kzldko78kpylkq5
https://security.netapp.com/advisory/ntap-20250523-0004/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.