VulnerabilityAnalyzed

CVE-2026-22187

Bio-Formats versions up to and including 8.3.0 perform unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing.

MEDIUM 6.8EPSS 0.52%

Does this matter?

Lower severity and a low EPSS score (0.52%). Track it; it rarely justifies an emergency change on its own.

Description

Bio-Formats versions up to and including 8.3.0 perform unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing. The loci.formats.Memoizer class automatically loads and deserializes memo files associated with images without validation, integrity checks, or trust enforcement. An attacker who can supply a crafted .bfmemo file alongside an image can trigger deserialization of untrusted data, which may result in denial of service, logic manipulation, or potentially remote code execution in environments where suitable gadget chains are present on the classpath.

CVSS 4.0: 6.8 MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.52% probability · 43th percentile
CISA KEV: Not listed
Weakness: CWE-502
Affected: openmicroscopy/bio-formats
Source: disclosure@vulncheck.com

References

https://docs.openmicroscopy.org/bio-formats/Release Notes
https://seclists.org/fulldisclosure/2026/Jan/7Mailing List
https://www.vulncheck.com/advisories/bio-formats-memoizer-unsafe-deserialization-via-bfmemo-cache-filesThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.