{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"8.3.0"}],"component":"ome:pom-bio-formats","cve_ids":["CVE-2026-22187"],"ecosystem":"Maven","epss":0.00512,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-qjm3-cvp9-3jj3","id":"tcs_01M5N99PNF6MMB3YPNT1NC26WK","modified_at":"2026-02-03T03:16:04.929406Z","published_at":"2026-01-07T21:31:56Z","references":["https://osv.dev/vulnerability/GHSA-qjm3-cvp9-3jj3","https://nvd.nist.gov/vuln/detail/CVE-2026-22187","https://docs.openmicroscopy.org/bio-formats","https://github.com/ome/bioformats","https://seclists.org/fulldisclosure/2026/Jan/7","https://www.vulncheck.com/advisories/bio-formats-memoizer-unsafe-deserialization-via-bfmemo-cache-files"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"GHSA-qjm3-cvp9-3jj3","url":"https://osv.dev/vulnerability/GHSA-qjm3-cvp9-3jj3"},{"source":"nvd","source_id":"CVE-2026-22187","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22187"}],"summary":"Bio-Formats performs unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing"}