The vulnerability arises from unsafe Java deserialization of attacker‑controlled memoization cache files (.bfmemo) that Bio‑Formats versions up to and including 8.3.0 automatically load during image processing. Because the Memoizer class performs no validation, integrity checks, or trust enforcement, a crafted .bfmemo file can trigger the deserialization of untrusted data, leading to denial of service, logic manipulation, or, in the presence of vulnerable gadget chains on the classpath, remote code execution. The weakness is classified as CWE‑502.

The affected product is Bio‑Formats provided by the Open Microscopy Environment. Versions up to and including 8.3.0 are impacted. The software is used in image‑processing pipelines on desktop and server environments that load biomedical image files.

The CVSS score of 6.8 indicates medium severity, and the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a malicious .bfmemo file that the application will load automatically, typically by providing a crafted image that triggers the deserialization path. No network‑based attack vectors are described, so the threat is mostly local or requires the attacker to place the file on a system that processes images with Bio‑Formats.