Security Exception in Apache POI: Vulnerability in Arrays.copyOfRange
Summary
OSV-2026-86: Security exception in java.base/java.util.Arrays.copyOfRange. Affects apache-poi versions >= c488cae3f3536253d0bd2c7580f08193dd70b2da, < 5eba19964228e87c675b13298cb23a308a083c63. Fixed in 5eba19964228e87c675b13298cb23a308a083c63. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache POI is a widely-used Java library that enables the manipulation of various file formats based on the Office Open XML standards and Microsoft's OLE 2 Compound Document format. It allows developers to create, modify, and read files in formats such as Excel, Word, and PowerPoint. This library is essential for applications that require document generation and processing. However, it has been identified that certain operations within the library can lead to security exceptions, particularly when using the Arrays.copyOfRange method, which can compromise the integrity of the application.
Vulnerability Detail
The vulnerability arises from a security exception triggered during the execution of the java.util.Arrays.copyOfRange method. This issue was reported through OSS-Fuzz, which highlighted a crash state involving the org.apache.poi.util.IOUtils.safelyClone and org.apache.poi.ddf.EscherBlipRecord.setPictureData methods. If exploited, this vulnerability could lead to application crashes and potentially expose sensitive data, making it critical for developers to address it promptly.
How To Fix
Minimum fixed version
5eba19964228e87c675b13298cb23a308a083c63
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using the affected methods in your code until the library is updated. Review your codebase for any instances of Arrays.copyOfRange and consider alternative implementations that do not invoke this method.
Conclusion
In summary, the security exception vulnerability in the Apache POI library related to the Arrays.copyOfRange method poses a risk to applications using this library. It is essential to update to the patched version to mitigate potential security threats. Additionally, utilizing tools like Vulert can help monitor and alert for vulnerabilities in real-time.
See every vulnerability recorded for apache-poi →
FAQ
The vulnerability is a security exception that occurs during the execution of the Arrays.copyOfRange method in the Apache POI library.
You can use Vulert, which monitors open-source vulnerabilities in your software. By checking your manifest file like package-lock.json, Vulert can alert you in real-time about any vulnerabilities, including this one.
Exploitation of this vulnerability can lead to application crashes and may expose sensitive data, compromising the security of your application.
Yes, a patch is available. The fixed version of Apache POI is 5eba19964228e87c675b13298cb23a308a083c63.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-poi.
