Listen to this Post
The vulnerability occurs in Bio-Formats versions up to and including 8.3.0, where the loci.formats.Memoizer class handles memoization cache files with the .bfmemo extension. During image processing, when Bio-Formats encounters an image file, it automatically looks for and loads an associated .bfmemo file to cache metadata and improve performance. This process involves Java deserialization of the .bfmemo file content without any security checks. The deserialization mechanism uses Java’s ObjectInputStream, which blindly trusts the serialized data from the file. An attacker can craft a malicious .bfmemo file by serializing harmful objects using tools like ysoserial to create gadget chains. When Bio-Formats deserializes this file, it executes the attacker’s code during the deserialization process. This happens because no validation, integrity checks, or digital signatures are applied to the .bfmemo files. The Memoizer class does not verify the source or content of the file, assuming it is from a trusted origin. By placing a crafted .bfmemo file alongside a legitimate image in a directory accessible to Bio-Formats, an attacker can trigger the deserialization. This can lead to instantiation of dangerous classes from the classpath, such as those enabling remote code execution. The vulnerability is particularly critical in environments where Bio-Formats is used in server-side applications or automated pipelines. The lack of sandboxing or security managers during deserialization amplifies the risk. Essentially, the trust boundary is broken, allowing untrusted data to influence object creation and behavior. This results from insecure default configurations that prioritize performance over security. The deserialization flaw leverages Java’s reflective capabilities to invoke methods on deserialized objects. Attackers can exploit this to achieve denial of service, logic manipulation, or full remote code execution if suitable gadget chains are present. The .bfmemo files are often stored in temporary or user-writable directories, increasing exposure. The automatic loading without user interaction makes it a silent threat. Patching requires disabling or securing the memoization feature to prevent arbitrary deserialization.
Platform: Bio-Formats
Version: <=8.3.0
Vulnerability: Unsafe Java Deserialization
Severity: Moderate
date: Jan 7, 2026
Prediction: Patch expected Jan 2026
What Undercode Say:
Analytics
bash
Check Bio-Formats version in project
java -cp bio-formats.jar loci.formats.FormatTools –version
List .bfmemo files in directory
find . -name “.bfmemo” -type f
Generate malicious serialized payload with ysoserial
java -jar ysoserial.jar CommonsCollections5 “touch /tmp/pwned” > malicious.bfmemo
Simulate deserialization attempt for testing
java -cp bio-formats.jar:. TestMemoizerLoad malicious.bfmemo
How Exploit
Craft malicious .bfmemo file using ysoserial gadget chains. Place it alongside target image file. Trigger Bio-Formats to process the image, causing automatic deserialization and code execution.
Protection from this CVE
Disable memoization via system properties. Update to patched version. Validate .bfmemo files with digital signatures. Use Java security managers to restrict deserialization.
Impact
Remote code execution possible. Denial of service. Logic manipulation in image processing.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
