CVE-2026-22187
📋 TL;DR
Bio-Formats up to version 8.3.0 has unsafe Java deserialization in the Memoizer class, allowing attackers to execute arbitrary code by providing malicious .bfmemo cache files alongside images. This affects all users processing images with Bio-Formats, particularly in scientific and medical imaging workflows. The vulnerability requires an attacker to supply a crafted file that gets loaded during image processing.
💻 Affected Systems
- Bio-Formats
📦 What is this software?
Bio Formats by Openmicroscopy
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the Bio-Formats process, potentially leading to complete system compromise.
Likely Case
Denial of service through application crashes or logic manipulation in image processing pipelines.
If Mitigated
Limited impact if file uploads are restricted and memoization is disabled.
🎯 Exploit Status
Exploitation requires crafting a malicious .bfmemo file and getting it loaded by the application, which depends on specific gadget chains in the classpath.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.3.1 or later
Vendor Advisory: https://docs.openmicroscopy.org/bio-formats/
Restart Required: Yes
Instructions:
1. Upgrade Bio-Formats to version 8.3.1 or later. 2. Restart any applications using Bio-Formats. 3. Clear existing .bfmemo cache files.
🔧 Temporary Workarounds
Disable memoization
allPrevent loading of .bfmemo files by disabling the memoization feature
Set system property: -Dloci.formats.Memoizer.enabled=false
Restrict file permissions
allPrevent unauthorized users from writing .bfmemo files to processing directories
chmod 644 *.bfmemo (Linux)
icacls *.bfmemo /deny Everyone:(W) (Windows)
🧯 If You Can't Patch
- Disable memoization feature completely via system property
- Implement strict file upload validation and sanitization for all image processing inputs
🔍 How to Verify
Check if Vulnerable:
Check Bio-Formats version: if ≤8.3.0 and memoization is enabled, system is vulnerable.Check Version:
java -cp bioformats_package.jar loci.formats.FormatTools --versionVerify Fix Applied:
Confirm Bio-Formats version is ≥8.3.1 and memoization uses safe serialization.📡 Detection & Monitoring
Log Indicators:
- Java deserialization errors
- Unexpected ClassNotFoundException during image processing
- Memoizer class loading failures
Network Indicators:
- Unusual file uploads with .bfmemo extensions
- Outbound connections from image processing services
SIEM Query:
source="*bioformats*" AND (event="deserialization" OR error="InvalidClassException")