Search

Find a vulnerability

Search criteria

    6 vulnerabilities found for openslide by OpenSlide

    CVE-2026-111130 (GCVE-0-2026-111130)

    Vulnerability from nvd – Published: 2026-10-15 18:57 – Updated: 2026-10-21 01:16
    VLAI
    Title
    OpenSlide through 4.0.1 Heap Out-of-Bounds Read via MIRAX get_tile_position
    Summary
    OpenSlide through 4.0.1 contains a heap out-of-bounds read vulnerability in the MIRAX reader that allows attackers to read past the slide_positions array via crafted Slidedat.ini values. Attackers can supply a MIRAX slide whose CameraImageDivisionsPerSide does not evenly divide the image counts, crashing applications that open it and corrupting tile geometry.
    Severity
    6.9 (Medium)
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
    6.1 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-21 01:16 UTC
    CWE
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 6614 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    OpenSlide openslide Affected: 0 , ≤ 4.0.1 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-15 00:00
    Credits
    HaiND from the Post and Telecommunication Institute of Technology
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111130",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-21T01:16:30.778396Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-21T01:16:55.790Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackmd.io/@haind-pwn/cve-2026-111130-openslide-mirax-slide-position-index-oob-read"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/openslide/openslide",
          "product": "openslide",
          "repo": "https://github.com/openslide/openslide",
          "vendor": "OpenSlide",
          "versions": [
            {
              "lessThanOrEqual": "4.0.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenSlide through 4.0.1 contains a heap out-of-bounds read vulnerability in the MIRAX reader that allows attackers to read past the slide_positions array via crafted Slidedat.ini values. Attackers can supply a MIRAX slide whose CameraImageDivisionsPerSide does not evenly divide the image counts, crashing applications that open it and corrupting tile geometry."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T18:57:25.805Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://hackmd.io/@haind-pwn/openslide-mirax-slide-position-index-oob-read"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/openslide/openslide/blob/fe79a9713bef2bfd64bbfefd15704060764b1274/src/openslide-vendor-mirax.c#L611-L635"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/openslide/openslide/blob/fe79a9713bef2bfd64bbfefd15704060764b1274/src/openslide-vendor-mirax.c#L1033-L1034"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/openslide/openslide"
        },
        {
          "name": "VulnCheck Advisory: OpenSlide through 4.0.1 Heap Out-of-Bounds Read via MIRAX get_tile_position",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openslide-through-4.0.1-heap-out-of-bounds-read-via-mirax-get-tile-position"
        }
      ],
      "title": "OpenSlide through 4.0.1 Heap Out-of-Bounds Read via MIRAX get_tile_position",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-111130",
    "datePublished": "2026-10-15T18:57:25.805Z",
    "dateReserved": "2026-10-15T17:03:52.918Z",
    "dateUpdated": "2026-10-21T01:16:55.790Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-54604 (GCVE-0-2026-54604)

    Vulnerability from nvd – Published: 2026-09-17 20:29 – Updated: 2026-09-18 20:06
    VLAI
    Title
    OpenSlide: openslide_read_region() returns uninitialized memory with libtiff 4.7.1
    Summary
    OpenSlide is a C library for reading whole slide image files. Prior to 4.0.1, a behavior change in libtiff 4.7.1 causes the indirect TIFF tile path in src/openslide-decode-tiff.c and _openslide_tiff_read_tile() to request a full-height destination for a partial bottom tile row, allowing uninitialized heap memory to enter pixel data returned by openslide_read_region(). A crafted but valid slide can trigger the issue in TIFF-based formats other than Hamamatsu NDPI when a network service renders attacker-provided slides. Successful extraction depends on pixel transparency handling and recompression, OpenSlide with libtiff 4.7.0 or earlier is not affected, and official binary builds 4.0.0.10 and 4.0.0.11 are affected. This issue is fixed in OpenSlide 4.0.1 and official binary build 4.0.0.12.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-18 20:06 UTC
    CWE
    • CWE-758 - Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
    • CWE-908 - Use of Uninitialized Resource
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7643 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    openslide openslide Affected: < 4.0.1
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54604",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T20:06:32.059828Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T20:06:41.600Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openslide",
          "vendor": "openslide",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenSlide is a C library for reading whole slide image files. Prior to 4.0.1, a behavior change in libtiff 4.7.1 causes the indirect TIFF tile path in src/openslide-decode-tiff.c and _openslide_tiff_read_tile() to request a full-height destination for a partial bottom tile row, allowing uninitialized heap memory to enter pixel data returned by openslide_read_region(). A crafted but valid slide can trigger the issue in TIFF-based formats other than Hamamatsu NDPI when a network service renders attacker-provided slides. Successful extraction depends on pixel transparency handling and recompression, OpenSlide with libtiff 4.7.0 or earlier is not affected, and official binary builds 4.0.0.10 and 4.0.0.11 are affected. This issue is fixed in OpenSlide 4.0.1 and official binary build 4.0.0.12."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-758",
              "description": "CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-908",
              "description": "CWE-908: Use of Uninitialized Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T20:29:15.840Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/openslide/openslide/security/advisories/GHSA-f734-jv98-5677",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/openslide/openslide/security/advisories/GHSA-f734-jv98-5677"
        },
        {
          "name": "https://github.com/openslide/openslide-bin/issues/433",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openslide/openslide-bin/issues/433"
        },
        {
          "name": "https://github.com/openslide/openslide-bin/pull/436",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openslide/openslide-bin/pull/436"
        },
        {
          "name": "https://github.com/openslide/openslide/pull/706",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openslide/openslide/pull/706"
        },
        {
          "name": "https://github.com/openslide/openslide/commit/a4f0fb0ec462edcea97ff22288f606ac6cd370f5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openslide/openslide/commit/a4f0fb0ec462edcea97ff22288f606ac6cd370f5"
        },
        {
          "name": "https://github.com/openslide/openslide/releases/tag/v4.0.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openslide/openslide/releases/tag/v4.0.1"
        },
        {
          "name": "https://gitlab.com/libtiff/libtiff/-/work_items/791",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.com/libtiff/libtiff/-/work_items/791"
        }
      ],
      "source": {
        "advisory": "GHSA-f734-jv98-5677",
        "discovery": "UNKNOWN"
      },
      "title": "OpenSlide: openslide_read_region() returns uninitialized memory with libtiff 4.7.1"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54604",
    "datePublished": "2026-09-17T20:29:15.840Z",
    "dateReserved": "2026-06-15T19:45:23.540Z",
    "dateUpdated": "2026-09-18T20:06:41.600Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-48977 (GCVE-0-2026-48977)

    Vulnerability from nvd – Published: 2026-09-17 20:26 – Updated: 2026-09-18 20:07
    VLAI
    Title
    OpenSlide: Arbitrary memory write with crafted Ventana BIF file
    Summary
    OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parse_level0_xml() processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts produce attacker-controlled relative memory offsets and allow arbitrary values to be written at those offsets, affecting all supported platforms and configurations and resulting in a crash or potential arbitrary code execution. This issue is fixed in version 4.0.1.
    Severity
    7.7 (High)
    CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-18 20:07 UTC
    CWE
    • CWE-123 - Write-what-where Condition
    • CWE-823 - Use of Out-of-range Pointer Offset
    • CWE-1284 - Improper Validation of Specified Quantity in Input
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7643 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    openslide openslide Affected: >= 3.4.1, < 4.0.1
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48977",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T20:07:02.848473Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T20:07:13.789Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openslide",
          "vendor": "openslide",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.4.1, \u003c 4.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide\u0027s parse_level0_xml() processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts produce attacker-controlled relative memory offsets and allow arbitrary values to be written at those offsets, affecting all supported platforms and configurations and resulting in a crash or potential arbitrary code execution. This issue is fixed in version 4.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-123",
              "description": "CWE-123: Write-what-where Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-823",
              "description": "CWE-823: Use of Out-of-range Pointer Offset",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284: Improper Validation of Specified Quantity in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T20:26:21.921Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/openslide/openslide/security/advisories/GHSA-mxg2-48g7-fmwc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/openslide/openslide/security/advisories/GHSA-mxg2-48g7-fmwc"
        },
        {
          "name": "https://github.com/openslide/openslide/pull/751",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openslide/openslide/pull/751"
        },
        {
          "name": "https://github.com/openslide/openslide/commit/2be88bd782d9fff46de8e56a99baca523e7917b3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openslide/openslide/commit/2be88bd782d9fff46de8e56a99baca523e7917b3"
        },
        {
          "name": "https://github.com/openslide/openslide/releases/tag/v4.0.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openslide/openslide/releases/tag/v4.0.1"
        }
      ],
      "source": {
        "advisory": "GHSA-mxg2-48g7-fmwc",
        "discovery": "UNKNOWN"
      },
      "title": "OpenSlide: Arbitrary memory write with crafted Ventana BIF file"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48977",
    "datePublished": "2026-09-17T20:26:21.921Z",
    "dateReserved": "2026-05-26T23:26:07.974Z",
    "dateUpdated": "2026-09-18T20:07:13.789Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-111130 (GCVE-0-2026-111130)

    Vulnerability from cvelistv5 – Published: 2026-10-15 18:57 – Updated: 2026-10-21 01:16
    VLAI
    Title
    OpenSlide through 4.0.1 Heap Out-of-Bounds Read via MIRAX get_tile_position
    Summary
    OpenSlide through 4.0.1 contains a heap out-of-bounds read vulnerability in the MIRAX reader that allows attackers to read past the slide_positions array via crafted Slidedat.ini values. Attackers can supply a MIRAX slide whose CameraImageDivisionsPerSide does not evenly divide the image counts, crashing applications that open it and corrupting tile geometry.
    Severity
    6.9 (Medium)
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
    6.1 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-21 01:16 UTC
    CWE
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 6614 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    OpenSlide openslide Affected: 0 , ≤ 4.0.1 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-15 00:00
    Credits
    HaiND from the Post and Telecommunication Institute of Technology
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111130",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-21T01:16:30.778396Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-21T01:16:55.790Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackmd.io/@haind-pwn/cve-2026-111130-openslide-mirax-slide-position-index-oob-read"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/openslide/openslide",
          "product": "openslide",
          "repo": "https://github.com/openslide/openslide",
          "vendor": "OpenSlide",
          "versions": [
            {
              "lessThanOrEqual": "4.0.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenSlide through 4.0.1 contains a heap out-of-bounds read vulnerability in the MIRAX reader that allows attackers to read past the slide_positions array via crafted Slidedat.ini values. Attackers can supply a MIRAX slide whose CameraImageDivisionsPerSide does not evenly divide the image counts, crashing applications that open it and corrupting tile geometry."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T18:57:25.805Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://hackmd.io/@haind-pwn/openslide-mirax-slide-position-index-oob-read"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/openslide/openslide/blob/fe79a9713bef2bfd64bbfefd15704060764b1274/src/openslide-vendor-mirax.c#L611-L635"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/openslide/openslide/blob/fe79a9713bef2bfd64bbfefd15704060764b1274/src/openslide-vendor-mirax.c#L1033-L1034"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/openslide/openslide"
        },
        {
          "name": "VulnCheck Advisory: OpenSlide through 4.0.1 Heap Out-of-Bounds Read via MIRAX get_tile_position",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openslide-through-4.0.1-heap-out-of-bounds-read-via-mirax-get-tile-position"
        }
      ],
      "title": "OpenSlide through 4.0.1 Heap Out-of-Bounds Read via MIRAX get_tile_position",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-111130",
    "datePublished": "2026-10-15T18:57:25.805Z",
    "dateReserved": "2026-10-15T17:03:52.918Z",
    "dateUpdated": "2026-10-21T01:16:55.790Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-54604 (GCVE-0-2026-54604)

    Vulnerability from cvelistv5 – Published: 2026-09-17 20:29 – Updated: 2026-09-18 20:06
    VLAI
    Title
    OpenSlide: openslide_read_region() returns uninitialized memory with libtiff 4.7.1
    Summary
    OpenSlide is a C library for reading whole slide image files. Prior to 4.0.1, a behavior change in libtiff 4.7.1 causes the indirect TIFF tile path in src/openslide-decode-tiff.c and _openslide_tiff_read_tile() to request a full-height destination for a partial bottom tile row, allowing uninitialized heap memory to enter pixel data returned by openslide_read_region(). A crafted but valid slide can trigger the issue in TIFF-based formats other than Hamamatsu NDPI when a network service renders attacker-provided slides. Successful extraction depends on pixel transparency handling and recompression, OpenSlide with libtiff 4.7.0 or earlier is not affected, and official binary builds 4.0.0.10 and 4.0.0.11 are affected. This issue is fixed in OpenSlide 4.0.1 and official binary build 4.0.0.12.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-18 20:06 UTC
    CWE
    • CWE-758 - Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
    • CWE-908 - Use of Uninitialized Resource
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7643 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    openslide openslide Affected: < 4.0.1
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54604",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T20:06:32.059828Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T20:06:41.600Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openslide",
          "vendor": "openslide",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenSlide is a C library for reading whole slide image files. Prior to 4.0.1, a behavior change in libtiff 4.7.1 causes the indirect TIFF tile path in src/openslide-decode-tiff.c and _openslide_tiff_read_tile() to request a full-height destination for a partial bottom tile row, allowing uninitialized heap memory to enter pixel data returned by openslide_read_region(). A crafted but valid slide can trigger the issue in TIFF-based formats other than Hamamatsu NDPI when a network service renders attacker-provided slides. Successful extraction depends on pixel transparency handling and recompression, OpenSlide with libtiff 4.7.0 or earlier is not affected, and official binary builds 4.0.0.10 and 4.0.0.11 are affected. This issue is fixed in OpenSlide 4.0.1 and official binary build 4.0.0.12."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-758",
              "description": "CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-908",
              "description": "CWE-908: Use of Uninitialized Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T20:29:15.840Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/openslide/openslide/security/advisories/GHSA-f734-jv98-5677",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/openslide/openslide/security/advisories/GHSA-f734-jv98-5677"
        },
        {
          "name": "https://github.com/openslide/openslide-bin/issues/433",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openslide/openslide-bin/issues/433"
        },
        {
          "name": "https://github.com/openslide/openslide-bin/pull/436",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openslide/openslide-bin/pull/436"
        },
        {
          "name": "https://github.com/openslide/openslide/pull/706",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openslide/openslide/pull/706"
        },
        {
          "name": "https://github.com/openslide/openslide/commit/a4f0fb0ec462edcea97ff22288f606ac6cd370f5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openslide/openslide/commit/a4f0fb0ec462edcea97ff22288f606ac6cd370f5"
        },
        {
          "name": "https://github.com/openslide/openslide/releases/tag/v4.0.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openslide/openslide/releases/tag/v4.0.1"
        },
        {
          "name": "https://gitlab.com/libtiff/libtiff/-/work_items/791",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.com/libtiff/libtiff/-/work_items/791"
        }
      ],
      "source": {
        "advisory": "GHSA-f734-jv98-5677",
        "discovery": "UNKNOWN"
      },
      "title": "OpenSlide: openslide_read_region() returns uninitialized memory with libtiff 4.7.1"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54604",
    "datePublished": "2026-09-17T20:29:15.840Z",
    "dateReserved": "2026-06-15T19:45:23.540Z",
    "dateUpdated": "2026-09-18T20:06:41.600Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-48977 (GCVE-0-2026-48977)

    Vulnerability from cvelistv5 – Published: 2026-09-17 20:26 – Updated: 2026-09-18 20:07
    VLAI
    Title
    OpenSlide: Arbitrary memory write with crafted Ventana BIF file
    Summary
    OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parse_level0_xml() processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts produce attacker-controlled relative memory offsets and allow arbitrary values to be written at those offsets, affecting all supported platforms and configurations and resulting in a crash or potential arbitrary code execution. This issue is fixed in version 4.0.1.
    Severity
    7.7 (High)
    CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-18 20:07 UTC
    CWE
    • CWE-123 - Write-what-where Condition
    • CWE-823 - Use of Out-of-range Pointer Offset
    • CWE-1284 - Improper Validation of Specified Quantity in Input
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7643 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    openslide openslide Affected: >= 3.4.1, < 4.0.1
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48977",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T20:07:02.848473Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T20:07:13.789Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openslide",
          "vendor": "openslide",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.4.1, \u003c 4.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide\u0027s parse_level0_xml() processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts produce attacker-controlled relative memory offsets and allow arbitrary values to be written at those offsets, affecting all supported platforms and configurations and resulting in a crash or potential arbitrary code execution. This issue is fixed in version 4.0.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-123",
              "description": "CWE-123: Write-what-where Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-823",
              "description": "CWE-823: Use of Out-of-range Pointer Offset",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284: Improper Validation of Specified Quantity in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T20:26:21.921Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/openslide/openslide/security/advisories/GHSA-mxg2-48g7-fmwc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/openslide/openslide/security/advisories/GHSA-mxg2-48g7-fmwc"
        },
        {
          "name": "https://github.com/openslide/openslide/pull/751",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openslide/openslide/pull/751"
        },
        {
          "name": "https://github.com/openslide/openslide/commit/2be88bd782d9fff46de8e56a99baca523e7917b3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openslide/openslide/commit/2be88bd782d9fff46de8e56a99baca523e7917b3"
        },
        {
          "name": "https://github.com/openslide/openslide/releases/tag/v4.0.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openslide/openslide/releases/tag/v4.0.1"
        }
      ],
      "source": {
        "advisory": "GHSA-mxg2-48g7-fmwc",
        "discovery": "UNKNOWN"
      },
      "title": "OpenSlide: Arbitrary memory write with crafted Ventana BIF file"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48977",
    "datePublished": "2026-09-17T20:26:21.921Z",
    "dateReserved": "2026-05-26T23:26:07.974Z",
    "dateUpdated": "2026-09-18T20:07:13.789Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}