CVE-2026-22187

{"id": "CVE-2026-22187", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22187", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-07T21:32:08.385631Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Open Microscopy Environment", "product": "Bio-Formats", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "8.3.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-07T21:16:02.600", "references": [{"url": "https://docs.openmicroscopy.org/bio-formats/", "tags": ["Release Notes"], "source": "disclosure@vulncheck.com"}, {"url": "https://seclists.org/fulldisclosure/2026/Jan/7", "tags": ["Mailing List"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/bio-formats-memoizer-unsafe-deserialization-via-bfmemo-cache-files", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Bio-Formats versions up to and including 8.3.0 perform unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing. The loci.formats.Memoizer class automatically loads and deserializes memo files associated with images without validation, integrity checks, or trust enforcement. An attacker who can supply a crafted .bfmemo file alongside an image can trigger deserialization of untrusted data, which may result in denial of service, logic manipulation, or potentially remote code execution in environments where suitable gadget chains are present on the classpath."}, {"lang": "es", "value": "Las versiones de Bio-Formats hasta la 8.3.0 inclusive realizan una deserializaci\u00f3n Java insegura de archivos de cach\u00e9 de memorizaci\u00f3n (.bfmemo) controlados por el atacante durante el procesamiento de im\u00e1genes. La clase loci.formats.Memoizer carga y deserializa autom\u00e1ticamente archivos memo asociados con im\u00e1genes sin validaci\u00f3n, comprobaciones de integridad o aplicaci\u00f3n de confianza. Un atacante que pueda proporcionar un archivo .bfmemo manipulado junto con una imagen puede desencadenar la deserializaci\u00f3n de datos no confiables, lo que puede resultar en denegaci\u00f3n de servicio, manipulaci\u00f3n l\u00f3gica o, potencialmente, ejecuci\u00f3n remota de c\u00f3digo en entornos donde existan cadenas de gadgets adecuadas en el classpath."}], "lastModified": "2026-06-17T10:19:30.483", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openmicroscopy:bio-formats:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "779C4146-854C-430E-BA48-A8AD79A97ADE", "versionEndIncluding": "8.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}