Bio-Formats versions up to and including 8.3.0 contain an XML External Entity vulnerability in the Leica Microsystems metadata parser. The insecurely configured DocumentBuilderFactory allows a crafted XML file to request external resources, load an external DTD, and expand entities during parsing. This can result in a server-side request to external hosts, read of local files that are accessible to the process, or a denial of service that stalls the XML parser. The weakness is classified as CWE-611, indicating insecure XML processing.

All installations of the Open Microscopy Environment’s Bio-Formats library version 8.3.0 or earlier that use the Leica XLEF metadata parser are affected. The vulnerability applies to any system that accepts or processes Leica XML-based metadata files using this parser.

The CVSS base score of 4.6 indicates moderate severity, and the EPSS probability of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would need the ability to supply a malicious Leica metadata file to the application, either locally or over a network if the system accepts external files. Once the file is parsed, the external entity requests and DTD loading can be triggered, potentially exposing internal data or causing service disruption. Exploit status for this vulnerability is currently unknown, but the conditions for successful exploitation are satisfied in environments that process untrusted XML metadata.