Read the docs
TI-2026-17797 Aliases CVE-2026-22187GHSA-qjm3-cvp9-3jj3

Bio-Formats <= 8.3.0 Memoizer Unsafe Deserialization via .bfmemo Cache Files

Priority MEDIUM 63CWE-502Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

Bio-Formats versions up to and including 8.3.0 perform unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing. The loci.formats.Memoizer class automatically loads and deserializes memo files associated with images without validation, integrity checks, or trust enforcement. An attacker who can supply a crafted .bfmemo file alongside an image can trigger deserialization of untrusted data, which may result in denial of service, logic manipulation, or potentially remote code execution in environments where suitable gadget chains are present on the classpath.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00512 43rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Open Microscopy EnvironmentBio-Formatsup to 8.3.0—No fix listedCNA
—ome:pom-bio-formats (Maven)up to 8.3.0—No fix listedGHSA-qjm3-cvp9-3jj3
  • Bio-Formats VendorOpen Microscopy Environment Affected up to 8.3.0 Fixed in — No fix listed CNA
  • ome:pom-bio-formats (Maven) Vendor— Affected up to 8.3.0 Fixed in — No fix listed GHSA-qjm3-cvp9-3jj3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openmicroscopy:bio-formats:*:*:*:*:*:*:*:*up to 8.3.0Vulnerableome
  • cpe:2.3:a:openmicroscopy:bio-formats:*:*:*:*:*:*:*:* Versions up to 8.3.0 Vulnerable ·ome

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-22187
  2. 2026-10-03 Alias added: GHSA-qjm3-cvp9-3jj3

References

Exploit 1

Advisory 1

Other 3

  • TI-2026-17796 Bio-Formats <= 8.3.0 XXE in Leica XLEF Metadata Parser CVSS 4.0MEDIUM 4.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences