Read the docs
TI-2026-39437 Aliases CVE-2026-54604

OpenSlide: openslide_read_region() returns uninitialized memory with libtiff 4.7.1

Priority LOW 25CWE-758Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-908 and the CVSS impact.

Summary

OpenSlide is a C library for reading whole slide image files. Prior to 4.0.1, a behavior change in libtiff 4.7.1 causes the indirect TIFF tile path in src/openslide-decode-tiff.c and _openslide_tiff_read_tile() to request a full-height destination for a partial bottom tile row, allowing uninitialized heap memory to enter pixel data returned by openslide_read_region(). A crafted but valid slide can trigger the issue in TIFF-based formats other than Hamamatsu NDPI when a network service renders attacker-provided slides. Successful extraction depends on pixel transparency handling and recompression, OpenSlide with libtiff 4.7.0 or earlier is not affected, and official binary builds 4.0.0.10 and 4.0.0.11 are affected. This issue is fixed in OpenSlide 4.0.1 and official binary build 4.0.0.12.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00527 44th percentileScored 2026-11-07
Fix Fixed openslide (openslide): 4.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openslideopenslidebefore 4.0.14.0.1Patch availableCNA
  • openslide Vendoropenslide Affected before 4.0.1 Fixed in 4.0.1 Patch available CNA

Remediation

  • Fix · CNA openslide (openslide) Fixed in 4.0.1

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54604
  2. 2026-11-03 Affected versions changed · Red Hat
  3. 2026-11-03 CVSS score added · Red Hat

References

Other 7

  • TI-2026-74914 Out-of-bounds read in OpenSlide MIRAX reader crashes apps CVSS 4.0MEDIUM 6.9
  • TI-2026-36233 OpenSlide: Arbitrary memory write with crafted Ventana BIF file CVSS 4.0HIGH 7.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences