CVE-2026-22186: Bio-Formats XXE Vulnerability

CVE-2026-22186 Overview

CVE-2026-22186 is an XML External Entity (XXE) vulnerability affecting Bio-Formats versions up to and including 8.3.0. The vulnerability exists in the Leica Microsystems metadata parsing component, specifically when processing Leica XML-based metadata files such as XLEF format. The parser uses an insecurely configured DocumentBuilderFactory that allows external entity expansion and external DTD loading.

When a user opens a crafted metadata file, attackers can exploit this vulnerability to trigger outbound network requests (Server-Side Request Forgery), access local system resources where readable, or cause a denial of service during XML parsing.

Critical Impact

Attackers can leverage crafted Leica microscopy metadata files to perform SSRF attacks, read local files, or disrupt scientific imaging workflows through denial of service.

Affected Products

• Bio-Formats versions up to and including 8.3.0
• Applications using the Bio-Formats library for Leica XLEF metadata parsing
• Scientific imaging pipelines processing untrusted Leica microscopy files

Discovery Timeline

• 2026-01-07 - CVE CVE-2026-22186 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2026-22186

Vulnerability Analysis

This XXE vulnerability stems from insecure XML parser configuration within the Bio-Formats library's Leica metadata parsing component. When processing XML-based metadata files from Leica microscopy systems, the DocumentBuilderFactory instance is not properly hardened against external entity attacks.

The vulnerability requires local access and user interaction—specifically, a user must open a malicious metadata file. While the attack complexity is low, the impact is constrained to confidentiality and availability concerns. An attacker can potentially read local files accessible to the application process, initiate outbound network connections to attacker-controlled servers (SSRF), or trigger resource exhaustion through recursive entity expansion (XML bomb attacks).

For additional technical details, refer to the FullDisclosure Security Mailing List Post and the VulnCheck Advisory on Bio-Formats XXE.

Root Cause

The root cause is classified as CWE-611 (Improper Restriction of XML External Entity Reference). The DocumentBuilderFactory used to parse Leica XML metadata files does not disable external entities or DTD processing. Secure XML parser configuration requires explicitly disabling features such as DOCTYPE declarations, external general entities, and external parameter entities.

When these security features are not configured, the XML parser will process entity declarations that can reference external resources, enabling attackers to exploit the parsing operation for malicious purposes.

Attack Vector

The attack vector is local, requiring an attacker to craft a malicious Leica XLEF or similar metadata file and convince a user to open it with an application that uses the vulnerable Bio-Formats library. The attack does not require privileges but does require user interaction.

A typical attack scenario involves:

1. An attacker crafts a malicious XML metadata file containing external entity declarations pointing to local files or external URLs
2. The file is distributed to targets through email, file sharing platforms, or scientific data repositories
3. When the victim opens the file using Bio-Formats-based imaging software, the XML parser processes the malicious entities
4. Depending on the entity payload, the attacker achieves file disclosure, SSRF, or denial of service

The malicious XML file would contain entity declarations that reference external DTDs or file paths. When parsed, the vulnerable DocumentBuilderFactory resolves these entities, leading to information disclosure or network requests to attacker-controlled infrastructure.

Detection Methods for CVE-2026-22186

Indicators of Compromise

• Unusual outbound network connections from scientific imaging applications
• Application logs showing errors related to XML parsing or external resource access failures
• Unexpected file access attempts from Bio-Formats-dependent processes
• Presence of suspicious XLEF or Leica metadata files with abnormal entity declarations

Detection Strategies

• Monitor network traffic from imaging applications for unexpected external connections
• Implement file integrity monitoring on scientific data repositories to detect malicious file uploads
• Review application logs for XML parsing errors or DTD resolution failures
• Deploy endpoint detection to alert on unusual process behavior from Bio-Formats applications

Monitoring Recommendations

• Enable verbose logging for applications using Bio-Formats to capture XML parsing activity
• Configure network monitoring to detect outbound connections from imaging workstations
• Implement file analysis pipelines to scan incoming microscopy metadata files for XXE payloads
• Monitor for DNS queries to suspicious domains from hosts running Bio-Formats software

How to Mitigate CVE-2026-22186

Immediate Actions Required

• Upgrade Bio-Formats to a patched version when available from Open Microscopy Environment
• Implement network segmentation for imaging workstations to limit SSRF impact
• Avoid opening untrusted Leica metadata files until patches are applied
• Configure application-level firewalls to restrict outbound connections from imaging software

Patch Information

Users should monitor the Open Microscopy Bio-Formats Documentation for security updates addressing this vulnerability. Review the VulnCheck Advisory on Bio-Formats XXE for the latest remediation guidance and patch availability information.

Workarounds

• Configure XML parsers at the application level to disable external entity processing if Bio-Formats allows customization
• Implement input validation to sanitize or reject XML files containing DOCTYPE declarations
• Use application sandboxing to limit the impact of potential file access or network requests
• Deploy network egress controls to block outbound connections from imaging application processes

# Example: Network egress restriction using iptables for imaging workstations
# Block outbound connections from specific user running imaging software
iptables -A OUTPUT -m owner --uid-owner imaging-user -p tcp --dport 80 -j DROP
iptables -A OUTPUT -m owner --uid-owner imaging-user -p tcp --dport 443 -j DROP