SB2025091029 - IBM watsonx.data update for Apache POI

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025091029

SB2025091029 - IBM watsonx.data update for Apache POI

Published: September 10, 2025

Security Bulletin ID SB2025091029
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Input validation error (CVE-ID: CVE-2025-31672)

The vulnerability allows a remote attacker to manipulate file parsing behavior.

The vulnerability stems from the way Apache POI handles zip entries in OOXML format files. When duplicate file names (including paths) exist within the zip structure, different products may select different zip entries with the same name, leading to inconsistent data interpretation. A remote attacker can manipulate file parsing behavior through specially crafted OOXML files containing ZIP entries with duplicate file names. This manipulation can result in inconsistent data processing across different systems, potentially leading to security issues and data integrity concerns.


Remediation

Install update from vendor's website.

References