CVE-2026-22187: 
Java vulnerability analysis and mitigation

CVE-2026-22187 is an unsafe Java deserialization vulnerability in Open Microscopy Environment's Bio-Formats library, affecting all versions up to and including 8.3.0. The flaw resides in the loci.formats.Memoizer class, which automatically loads and deserializes .bfmemo memoization cache files during image processing without any validation, integrity checks, or trust enforcement. It was disclosed on January 7, 2026, with the CVE assigned by VulnCheck. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 6.8 (Medium) (GitHub Advisory, VulnCheck Advisory).

The root cause is CWE-502 (Deserialization of Untrusted Data): the loci.formats.Memoizer class in Bio-Formats automatically locates and deserializes .bfmemo cache files associated with images being processed, without performing any signature verification, integrity checks, or allowlist-based class filtering. An attacker must be able to place a crafted .bfmemo file in a location where it will be picked up alongside a legitimate image file — a local or shared filesystem access scenario requiring user interaction (i.e., a user or automated pipeline must open the associated image). If suitable Java deserialization gadget chains (e.g., from libraries such as Apache Commons Collections) are present on the application classpath, the crafted payload can escalate from denial of service to arbitrary code execution (GitHub Advisory, VulnCheck Advisory).

Successful exploitation can result in denial of service, logic manipulation, or remote code execution depending on the Java classpath of the target environment. Where gadget chains are available, an attacker could achieve full compromise of the host running the Bio-Formats image processing pipeline, potentially exposing sensitive research data (e.g., microscopy images, patient data in biomedical contexts) and enabling lateral movement within the environment. The CVSS v3.1 scoring reflects high confidentiality, integrity, and availability impacts (GitHub Advisory, VulnCheck Advisory).

1. Reconnaissance: Identify target environments running Bio-Formats versions ≤ 8.3.0, particularly automated image processing pipelines, scientific workstations, or servers in biomedical/research settings that process user-supplied or externally sourced microscopy images.
2. Identify memo file location: Determine the directory where Bio-Formats stores or reads .bfmemo cache files — by default, these are placed in the same directory as the source image or a configured cache directory.
3. Craft malicious .bfmemo file: Using a Java deserialization payload generator (e.g., ysoserial) and a gadget chain available on the target classpath (e.g., CommonsCollections, Spring, etc.), generate a serialized Java object payload that executes a desired command upon deserialization.
4. Place the payload: Write the crafted .bfmemo file to the target directory alongside a legitimate image file, using any available write access (e.g., shared network storage, file upload functionality in an application using Bio-Formats, or social engineering).
5. Trigger deserialization: Wait for or induce a user or automated process to open the associated image file using Bio-Formats. The Memoizer class will automatically locate and deserialize the .bfmemo file without validation, executing the embedded payload.
6. Achieve objective: Depending on the gadget chain used, the attacker may obtain a reverse shell, execute arbitrary commands, exfiltrate data, or cause a denial of service on the processing host (PoC GitHub, VulnCheck Advisory).

• File System: Unexpected or newly created .bfmemo files in image directories or Bio-Formats cache directories, especially files not generated by the local system or with anomalous timestamps; presence of web shells or new executables in directories writable by the Java process.
• Process: Unusual child processes spawned by the Java process running Bio-Formats (e.g., bash, sh, cmd.exe, powershell, curl, wget, python); unexpected network connections initiated by the Java process.
• Network: Outbound connections from the Bio-Formats host to unknown external IP addresses or C2 infrastructure, particularly shortly after image processing events.
• Logs: Java stack traces or error messages referencing loci.formats.Memoizer deserialization failures; unexpected ClassNotFoundException or InvalidClassException entries in application logs that may indicate failed or probing deserialization attempts.

Upgrade Bio-Formats to version 8.3.1 or later, which addresses this vulnerability (GitHub Advisory, Bio-Formats Docs). As interim mitigations, restrict write access to image processing directories so that untrusted parties cannot place .bfmemo files alongside images, and implement file integrity monitoring on cache directories. Where possible, reduce the application classpath to exclude unnecessary libraries that provide known Java deserialization gadget chains (e.g., Apache Commons Collections). Organizations should also consider disabling the Memoizer caching feature entirely if it is not required for their workflows (VulnCheck Advisory).

The vulnerability was reported and assigned by VulnCheck, with disclosure via the Full Disclosure mailing list on January 7, 2026 (SecLists Full Disclosure). The GitHub Advisory Database rated it as "Moderate" severity based on the CVSS v4.0 score, while NVD's CVSS v3.1 analysis assigned it a "High" rating, reflecting some divergence in severity assessment. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified.