george0papasotiriou/cve-2026-22187-bio-formats-unsafe-java-deserialization-via-.bfmemoBio-Formats ≤ 8.3.0 performs unsafe Java deserialization of attacker-controlled .bfmemo cache files during image processing; crafted .bfmemo can trigger deserialization of untrusted data (DoS/logic manipulation; potentially RCE if gadget chains exist).
Bio-Formats ≤ 8.3.0 performs unsafe Java deserialization of attacker-controlled .bfmemo cache files during image processing; crafted .bfmemo can trigger deserialization of untrusted data (DoS/logic manipulation; potentially RCE if gadget chains exist).
Safe reproduction (local-only) This does NOT build a gadget chain or execute code. It only shows that .bfmemo gets deserialized for demonstration purposes.
javac -cp bioformats_package.jar DemoMemoizer.java java -cp .:bioformats_package.jar DemoMemoizer ./sample.tif
This is appropriate for education because it demonstrates the unsafe deserialization surface without malicious use.
