CVE-2026-22186

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22186", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-01-06T16:47:17.182Z", "datePublished": "2026-01-07T20:26:48.324Z", "dateUpdated": "2026-11-08T14:01:10.169Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:01:10.169Z"}, "title": "Bio-Formats <= 8.3.0 XXE in Leica XLEF Metadata Parser", "descriptions": [{"lang": "en", "value": "Bio-Formats versions up to and including 8.3.0 contain an XML External Entity (XXE) vulnerability in the Leica Microsystems metadata parsing component (e.g., XLEF). The parser uses an insecurely configured DocumentBuilderFactory when processing Leica XML-based metadata files, allowing external entity expansion and external DTD loading. A crafted metadata file can trigger outbound network requests (SSRF), access local system resources where readable, or cause a denial of service during XML parsing.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Bio-Formats versions up to and including 8.3.0 contain an XML External Entity (XXE) vulnerability in the Leica Microsystems metadata parsing component (e.g., XLEF). The parser uses an insecurely configured DocumentBuilderFactory when processing Leica XML-based metadata files, allowing external entity expansion and external DTD loading. A crafted metadata file can trigger outbound network requests (SSRF), access local system resources where readable, or cause a denial of service during XML parsing."}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-611", "description": "CWE-611 Improper Restriction of XML External Entity Reference", "type": "CWE"}]}], "affected": [{"vendor": "Open Microscopy Environment", "product": "Bio-Formats", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "8.3.0", "versionType": "semver"}], "defaultStatus": "unaffected", "packageURL": "pkg:maven/ome/pom-bio-formats"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openmicroscopy:bio-formats:*:*:*:*:*:*:*:*", "versionEndIncluding": "8.3.0"}]}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 4.6, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N"}}], "references": [{"url": "https://seclists.org/fulldisclosure/2026/Jan/6", "tags": ["technical-description", "exploit"]}, {"url": "https://github.com/ome/bioformats/security/advisories/GHSA-x9vc-qh97-8gjp", "name": "GitHub Security Advisory (GHSA-x9vc-qh97-8gjp)", "tags": ["vendor-advisory"]}, {"url": "https://docs.openmicroscopy.org/bio-formats/", "tags": ["product", "release-notes"]}, {"url": "https://www.vulncheck.com/advisories/bio-formats-xxe-in-leica-xlef-metadata-parser", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Ron Edgerson", "type": "finder"}, {"lang": "en", "value": "Beatriz Fresno Naumova", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-07T21:16:47.850182Z", "id": "CVE-2026-22186", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T21:17:25.927Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22186", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-07T21:16:47.850182Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T21:17:15.246Z"}}], "cna": {"title": "Bio-Formats <= 8.3.0 XXE in Leica XLEF Metadata Parser", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Ron Edgerson"}, {"lang": "en", "type": "finder", "value": "Beatriz Fresno Naumova"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.6, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Open Microscopy Environment", "product": "Bio-Formats", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "8.3.0"}], "packageURL": "pkg:maven/ome/pom-bio-formats", "defaultStatus": "unaffected"}], "references": [{"url": "https://seclists.org/fulldisclosure/2026/Jan/6", "tags": ["technical-description", "exploit"]}, {"url": "https://github.com/ome/bioformats/security/advisories/GHSA-x9vc-qh97-8gjp", "name": "GitHub Security Advisory (GHSA-x9vc-qh97-8gjp)", "tags": ["vendor-advisory"]}, {"url": "https://docs.openmicroscopy.org/bio-formats/", "tags": ["product", "release-notes"]}, {"url": "https://www.vulncheck.com/advisories/bio-formats-xxe-in-leica-xlef-metadata-parser", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Bio-Formats versions up to and including 8.3.0 contain an XML External Entity (XXE) vulnerability in the Leica Microsystems metadata parsing component (e.g., XLEF). The parser uses an insecurely configured DocumentBuilderFactory when processing Leica XML-based metadata files, allowing external entity expansion and external DTD loading. A crafted metadata file can trigger outbound network requests (SSRF), access local system resources where readable, or cause a denial of service during XML parsing.", "supportingMedia": [{"type": "text/html", "value": "Bio-Formats versions up to and including 8.3.0 contain an XML External Entity (XXE) vulnerability in the Leica Microsystems metadata parsing component (e.g., XLEF). The parser uses an insecurely configured DocumentBuilderFactory when processing Leica XML-based metadata files, allowing external entity expansion and external DTD loading. A crafted metadata file can trigger outbound network requests (SSRF), access local system resources where readable, or cause a denial of service during XML parsing.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-611", "description": "CWE-611 Improper Restriction of XML External Entity Reference"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openmicroscopy:bio-formats:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "8.3.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:01:10.169Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22186", "state": "PUBLISHED", "dateUpdated": "2026-11-08T14:01:10.169Z", "dateReserved": "2026-01-06T16:47:17.182Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-01-07T20:26:48.324Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:maven/ome/pom-bio-formats", "product": "Bio-Formats", "vendor": "Open Microscopy Environment", "versions": [{"lessThanOrEqual": "8.3.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openmicroscopy:bio-formats:*:*:*:*:*:*:*:*", "matchCriteriaId": "779C4146-854C-430E-BA48-A8AD79A97ADE", "versionEndIncluding": "8.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Bio-Formats versions up to and including 8.3.0 contain an XML External Entity (XXE) vulnerability in the Leica Microsystems metadata parsing component (e.g., XLEF). The parser uses an insecurely configured DocumentBuilderFactory when processing Leica XML-based metadata files, allowing external entity expansion and external DTD loading. A crafted metadata file can trigger outbound network requests (SSRF), access local system resources where readable, or cause a denial of service during XML parsing."}, {"lang": "es", "value": "Las versiones de Bio-Formats hasta la 8.3.0 inclusive contienen una vulnerabilidad de entidad externa XML (XXE) en el componente de an\u00e1lisis de metadatos de Leica Microsystems (p. ej., XLEF). El analizador utiliza una DocumentBuilderFactory configurada de forma insegura al procesar archivos de metadatos de Leica basados en XML, lo que permite la expansi\u00f3n de entidades externas y la carga de DTD externas. Un archivo de metadatos manipulado puede desencadenar solicitudes de red salientes (SSRF), acceder a recursos del sistema local donde sean legibles o causar una denegaci\u00f3n de servicio durante el an\u00e1lisis XML."}], "id": "CVE-2026-22186", "lastModified": "2026-10-08T16:17:10.947", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22186", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-07T21:16:47.850182Z", "version": "2.0.3"}}]}, "published": "2026-01-07T21:16:02.433", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Release Notes"], "url": "https://docs.openmicroscopy.org/bio-formats/"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/ome/bioformats/security/advisories/GHSA-x9vc-qh97-8gjp"}, {"source": "disclosure@vulncheck.com", "tags": ["Mailing List"], "url": "https://seclists.org/fulldisclosure/2026/Jan/6"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/bio-formats-xxe-in-leica-xlef-metadata-parser"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T16:49:37.209820+00:00", "value": {"mitigation_remediation": ["Upgrade Bio-Formats to the latest release\u2014at least 8.3.1\u2014where the XML parser has been hardened against XXE.", "If an upgrade cannot be performed immediately, reconfigure the parser to disallow external entities by setting the secure-processing and disallow-doctype-decl features and disabling external DTD loading.", "Validate incoming Leica metadata files against a predefined schema or whitelist before parsing, and restrict the parser\u2019s outbound network connections to mitigate SSRF."], "summary": {"action": "Patch", "impact": "Potential data disclosure and SSRF through crafted Leica metadata"}, "threat_synthesis": {"affected_systems": "All installations of the Open Microscopy Environment\u2019s Bio-Formats library version 8.3.0 or earlier that use the Leica XLEF metadata parser are affected. The vulnerability applies to any system that accepts or processes Leica XML-based metadata files using this parser.", "description_and_impact": "Bio-Formats versions up to and including 8.3.0 contain an XML External Entity vulnerability in the Leica Microsystems metadata parser. The insecurely configured DocumentBuilderFactory allows a crafted XML file to request external resources, load an external DTD, and expand entities during parsing. This can result in a server-side request to external hosts, read of local files that are accessible to the process, or a denial of service that stalls the XML parser. The weakness is classified as CWE-611, indicating insecure XML processing.", "risk_and_exploitability": "The CVSS base score of 4.6 indicates moderate severity, and the EPSS probability of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would need the ability to supply a malicious Leica metadata file to the application, either locally or over a network if the system accepts external files. Once the file is parsed, the external entity requests and DTD loading can be triggered, potentially exposing internal data or causing service disruption. Exploit status for this vulnerability is currently unknown, but the conditions for successful exploitation are satisfied in environments that process untrusted XML metadata."}}}}, "created": "2026-04-18T17:00:05.565201+00:00", "updated": "2026-04-18T17:00:05.565212+00:00", "vendors": []}