CVE-2026-22186

Bio-Formats <= 8.3.0 XXE in Leica XLEF Metadata Parser

CVSS 4.6 MEDIUMEPSS 0.1%CWE-611

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 4.6EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

07 jan 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Bio-Formats versions up to and including 8.3.0 contain an XML External Entity (XXE) vulnerability in the Leica Microsystems metadata parsing component (e.g., XLEF). The parser uses an insecurely configured DocumentBuilderFactory when processing Leica XML-based metadata files, allowing external entity expansion and external DTD loading. A crafted metadata file can trigger outbound network requests (SSRF), access local system resources where readable, or cause a denial of service during XML parsing.

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Produtos afetados

Open Microscopy Environment · Bio-Formats

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://docs.openmicroscopy.org/bio-formats/https://github.com/ome/bioformats/security/advisories/GHSA-x9vc-qh97-8gjp https://seclists.org/fulldisclosure/2026/Jan/6 https://www.vulncheck.com/advisories/bio-formats-xxe-in-leica-xlef-metadata-parser