CVE-2026-22186: 
Java vulnerability analysis and mitigation

CVE-2026-22186 is an XML External Entity (XXE) vulnerability in the Open Microscopy Environment's Bio-Formats library, specifically in the Leica Microsystems metadata parsing component (e.g., XLEF files). It affects Bio-Formats versions up to and including 8.4.0, with the initial disclosure covering versions up to 8.3.0. The vulnerability was published on January 7, 2026, and assigned by VulnCheck. It carries a CVSS v3.1 base score of 7.1 (High) per NIST NVD, and a CVSS v4.0 base score of 4.6 (Medium) per the CNA (GitHub Advisory, ome/bioformats Advisory).

The root cause is classified as CWE-611 (Improper Restriction of XML External Entity Reference) and additionally CWE-776 (Improper Restriction of Recursive Entity References in DTDs). The vulnerability stems from an insecurely configured DocumentBuilderFactory in the Leica metadata parser that permits external entity expansion and external DTD loading without restriction. An attacker crafts a malicious Leica XML-based metadata file (e.g., .xlef) embedding external entity declarations that, when parsed by Bio-Formats, trigger outbound network requests (SSRF), local file reads, or recursive entity expansion leading to denial of service. Exploitation requires user interaction — specifically, a user must open or process the crafted metadata file — but requires no privileges (ome/bioformats Advisory, VulnCheck Advisory).

Successful exploitation can result in high confidentiality impact through unauthorized access to local system files readable by the Bio-Formats process, and high availability impact through denial of service during XML parsing (per CVSS v3.1 scoring). Additionally, the vulnerability enables Server-Side Request Forgery (SSRF), allowing outbound network requests to internal or external resources from the host running Bio-Formats, which could facilitate reconnaissance of internal network infrastructure. Integrity is not directly impacted. The scope is limited to the vulnerable system and does not extend to subsequent systems (GitHub Advisory, ome/bioformats Advisory).

1. Craft a malicious Leica metadata file: Create a .xlef or similar Leica XML-based metadata file containing an XXE payload. For a file read attack, embed an external entity declaration such as:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root>&xxe;</root>

For SSRF, replace the file:// URI with an http:// URI pointing to an internal resource (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata).

2. Deliver the file to the target: Social-engineer a researcher or lab technician who uses Bio-Formats (e.g., via OMERO or ImageJ/Fiji with Bio-Formats plugin) into opening the crafted file, or place it in a shared directory where automated processing occurs.

3. Trigger parsing: The victim opens the file using a Bio-Formats-enabled application. The insecurely configured DocumentBuilderFactory resolves the external entity reference.

4. Exfiltrate data or probe internal network: For file reads, the contents of the referenced local file are embedded in the parsed output or trigger an error message containing the data. For SSRF, the Bio-Formats host makes an outbound HTTP request to the attacker-controlled or internal URL, potentially leaking responses or enabling further internal network mapping (ome/bioformats Advisory, VulnCheck Advisory).

• Network: Unexpected outbound HTTP/HTTPS or DNS requests from systems running Bio-Formats to external or internal IP addresses not associated with normal microscopy workflows; outbound connections to attacker-controlled servers during file open operations.
• Logs: Java exception stack traces in application logs referencing DocumentBuilderFactory, external entity resolution failures, or DTD loading errors during Leica metadata parsing; unusual file access patterns in system audit logs (e.g., reads of /etc/passwd, SSH keys, or configuration files) by the Bio-Formats Java process.
• Process: The Bio-Formats Java process (e.g., java) initiating unexpected network connections or file reads outside of normal microscopy data directories.
• File System: Presence of unexpected or externally sourced .xlef or other Leica XML metadata files in directories processed by Bio-Formats.

The Open Microscopy Environment has released Bio-Formats version 8.5.0 as the patched release, which addresses this XXE vulnerability by properly configuring DocumentBuilderFactory to disable external entity resolution and DTD loading. Users should upgrade to Bio-Formats 8.5.0 or higher immediately. No official workarounds are available from the vendor. As interim mitigations, organizations should restrict processing of Leica metadata files to trusted sources only, implement network egress filtering to limit SSRF impact from Bio-Formats hosts, and monitor for unusual outbound connections from systems running Bio-Formats (ome/bioformats Advisory, VulnCheck Advisory).

The vulnerability was reported by security researcher Beatriz Fresno Naumova (beafn28), credited in the official ome/bioformats security advisory. The disclosure was also published to the Full Disclosure mailing list in January 2026. Community and media attention has been limited, consistent with the niche scientific software audience of Bio-Formats (ome/bioformats Advisory, Full Disclosure).