The Open Microscopy Environment Bio-Formats product versions up to and including 8.3.0 perform unsafe Java deserialization of memoization cache files (.bfmemo) during image processing. The loci.formats.Memoizer class automatically loads and deserializes these files without any validation, integrity checks, or trust enforcement. This allows an attacker who can supply a crafted .bfmemo file alongside an image to trigger deserialization of untrusted data. The impact includes denial of service, logic manipulation, or potentially remote code execution in environments where appropriate Java gadget chains are present on the classpath. No patch or remediation information is provided in the available data.

Exploitation of this vulnerability can lead to denial of service, manipulation of application logic, or remote code execution if the environment contains suitable Java gadget chains. The vulnerability arises from unsafe deserialization of attacker-controlled data without validation or integrity checks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid processing untrusted or attacker-controlled .bfmemo files alongside images. Implementing strict input validation or disabling automatic deserialization of memoization cache files may reduce risk, but these measures depend on application context and are not confirmed by the vendor.