CVE-2026-22187
Bio-Formats versions up to and including 8.3.0 perform unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing. The loci.formats.Memoizer class ...
Affects 1 product across 1 vendor.
Software deserializes untrusted data without validation, allowing crafted objects to execute arbitrary code.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
Bio-Formats versions up to and including 8.3.0 are vulnerable to unsafe Java deserialization due to the automatic loading and deserialization of attacker-controlled memoization cache files (.bfmemo) without proper validation or trust enforcement.
BSID: BS-2026-GLOBAL-067231-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2026-22187?
What is the CVSS score for CVE-2026-22187?
Is CVE-2026-22187 actively exploited?
How do I remediate CVE-2026-22187?
What systems are affected by CVE-2026-22187?
| CVE ID | CVE-2026-22187 |
|---|---|
| BSID | BS-2026-GLOBAL-067231-H BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| Published | 2026-01-07 |
| Last Modified | 2026-10-08 |
| ICS Relevance | 15% |
| Weakness (CWE) | |
| Source | NVD |
Bio-Formats versions up to and including 8.3.0 perform unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing. The loci.formats.Memoizer class automatically loads and deserializes memo files associated with images without validation, integrity checks, or trust enforcement. An attacker who can supply a crafted .bfmemo file alongside an image can trigger deserialization of untrusted data, which may result in denial of service, logic manipulation, or potentially remote code execution in environments where suitable gadget chains are present on the classpath.
Source: NIST NVD / MITRE CVE Database
An attacker can exploit this vulnerability by supplying a crafted .bfmemo file alongside an image. The loci.formats.Memoizer class in Bio-Formats automatically loads and deserializes these files, which can lead to remote code execution if the attacker crafts the file to include malicious serialized objects.
Exploitation Likelihood: MEDIUM
| Vendor | Product | Affected Versions |
|---|---|---|
| Openmicroscopy | Bio-Formats | ≤ 8.3.0 |
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
AI Enrichment Record — provenance & audit hash
| Model | /workspace/models/qwen2.5-coder-32b-instruct-bf16 |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | b704a8aac8c908b9c9c3a0edb37664e9db293632b505eea36931e9278c8ff791ef5a78087291323063bb4b6206ebbc4ec05cb5f948582cb7352eec6d30cb6f5b |
ICS/OT Vulnerability Intelligence for Your Environment
BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.
Create a free account →