PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-22187 Open Microscopy Environment CVE debrief

Bio-Formats versions up to and including 8.3.0 perform unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing. The loci.formats.Memoizer class automatically loads and deserializes memo files associated with images without validation, integrity checks, or trust enforcement. An attacker who can supply a crafted .bfmemo file alongside an image can trigger deserialization of untrusted data, which may result in denial of service, logic manipulation, or potentially remote code execution in environments where suitable gadget chains are present on the classpath.

Vendor
Open Microscopy Environment
Product
Bio-Formats
CVSS
MEDIUM 6.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-01-07
Original CVE updated
2026-10-08
Advisory published
2026-01-07
Advisory updated
2026-10-08

Who should care

Defenders responsible for image processing workflows, especially those handling .bfmemo files, should assess the exposure of Bio-Formats versions up to 8.3.0 in their environments and prioritize verification and potential upgrades.

Why it matters

Defenders should care about CVE-2026-22187 because it involves unsafe deserialization of attacker-controlled .bfmemo files in Bio-Formats versions up to 8.3.0, which can lead to denial of service, logic manipulation, or remote code execution. Roles responsible for image processing workflows and Bio-Formats deployments should assess exposure and prioritize verification and remediation.

  • Denial of service through deserialization of untrusted data.
  • Logic manipulation via unsafe deserialization of .bfmemo files.
  • Potential remote code execution in environments with suitable gadget chains.

Technical summary

The loci.formats.Memoizer class in Bio-Formats versions up to 8.3.0 performs unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing. This can lead to denial of service, logic manipulation, or potentially remote code execution in environments with suitable gadget chains on the classpath. Defenders should prioritize verifying the integrity of image processing workflows, especially those handling .bfmemo files, and assess the exposure of Bio-Formats versions up to 8.3.0 in their environments. The CVE record and source item provide details on the vulnerability in Bio-Formats versions up to 8.3.0, including the unsafe deserialization of .bfmemo files.

Defensive priority

Defenders should prioritize verifying the integrity of image processing workflows, especially those handling .bfmemo files, and assess the exposure of Bio-Formats versions up to 8.3.0 in their environments.

Recommended defensive actions

  • Verify the integrity of image processing workflows, especially those handling .bfmemo files.
  • Assess the exposure of Bio-Formats versions up to 8.3.0 in your environment.
  • Implement validation, integrity checks, and trust enforcement for .bfmemo files.
  • Consider upgrading to a version of Bio-Formats beyond 8.3.0 if possible.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability in Bio-Formats versions up to 8.3.0, including the unsafe deserialization of .bfmemo files. However, the corpus does not establish versions, exploitation, impact, or remediation beyond denial of service, logic manipulation, or potential remote code execution in specific environments.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-22187 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-22187

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-22187 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-22187

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Bio-Formats <= 8.3.0 Memoizer Unsafe Deserialization via .bfmemo Cache Files

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/22xxx/CVE-2026-22187.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://seclists.org/fulldisclosure/2026/Jan/7

    Supplemental source - technical-description, exploit

  • Source reference

    Unverified legacy reference

    URL: https://docs.openmicroscopy.org/bio-formats/

    Supplemental source - product, release-notes

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/bio-formats-memoizer-unsafe-deserialization-via-bfmemo-cache-files

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.