Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Apache POI spreadsheet library may cause security exception
published 7 months ago
Summary
The Apache POI library that handles Excel files can trigger a security exception when it processes certain formula structures, which may cause the application to crash. This can interrupt any business process that relies on reading or writing Excel documents with POI. Upgrade to the newest POI release or apply the vendor’s recommended patch to prevent the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| OSS-Fuzz | – | apache-poi | All versions |
Original advisory text
Security exception in org.apache.poi.ss.formula.OperandClassTransformer.transformNode
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=499126302
```
Crash type: Security exception
Crash state:
org.apache.poi.ss.formula.OperandClassTransformer.transformNode
org.apache.poi.ss.formula.OperandClassTransformer.isSimpleValueFunction
org.apache.poi.ss.formula.OperandClassTransformer.transformNode
```
```
Crash type: Security exception
Crash state:
org.apache.poi.ss.formula.OperandClassTransformer.transformNode
org.apache.poi.ss.formula.OperandClassTransformer.isSimpleValueFunction
org.apache.poi.ss.formula.OperandClassTransformer.transformNode
```
References
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=499126302 Third Party Advisory
Timeline
Published4 Apr 2026
Updated3 Nov 2026
First seen3 Nov 2026
Sources
OSV-2026-524 · OSV
Track software like this
Free during beta