SB2026012936 - IBM Engineering Lifecycle Management - Jazz Foundation update for Apache POI 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026012936

SB2026012936 - IBM Engineering Lifecycle Management - Jazz Foundation update for Apache POI

Published: January 29, 2026

Security Bulletin ID SB2026012936
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Input validation error (CVE-ID: CVE-2025-31672)

The vulnerability allows a remote attacker to manipulate file parsing behavior.

The vulnerability stems from the way Apache POI handles zip entries in OOXML format files. When duplicate file names (including paths) exist within the zip structure, different products may select different zip entries with the same name, leading to inconsistent data interpretation. A remote attacker can manipulate file parsing behavior through specially crafted OOXML files containing ZIP entries with duplicate file names. This manipulation can result in inconsistent data processing across different systems, potentially leading to security issues and data integrity concerns.


Remediation

Install update from vendor's website.

References