VulnerabilityModified

CVE-2026-22186

Bio-Formats versions up to and including 8.3.0 contain an XML External Entity (XXE) vulnerability in the Leica Microsystems metadata parsing component (e.g., XLEF).

MEDIUM 4.6EPSS 0.17%

Does this matter?

Lower severity and a low EPSS score (0.17%). Track it; it rarely justifies an emergency change on its own.

Description

Bio-Formats versions up to and including 8.3.0 contain an XML External Entity (XXE) vulnerability in the Leica Microsystems metadata parsing component (e.g., XLEF). The parser uses an insecurely configured DocumentBuilderFactory when processing Leica XML-based metadata files, allowing external entity expansion and external DTD loading. A crafted metadata file can trigger outbound network requests (SSRF), access local system resources where readable, or cause a denial of service during XML parsing.

CVSS 4.0: 4.6 MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.17% probability · 7th percentile
CISA KEV: Not listed
Weakness: CWE-611
Affected: openmicroscopy/bio-formats
Source: disclosure@vulncheck.com

References

https://docs.openmicroscopy.org/bio-formats/Release Notes
https://github.com/ome/bioformats/security/advisories/GHSA-x9vc-qh97-8gjp
https://seclists.org/fulldisclosure/2026/Jan/6Mailing List
https://www.vulncheck.com/advisories/bio-formats-xxe-in-leica-xlef-metadata-parserThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.