debian/openslide vulnerabilities

Latest debian/openslide CVEs

Newest publication first

1. CVE-2026-111130 OpenSlide through 4.0.1 Heap Out-of-Bounds Read via MIRAX get_tile_position

   Published 2026-10-15

   Medium·CVSS 6.9 EPSS 0.20%

   OpenSlide through 4.0.1 contains a heap out-of-bounds read vulnerability in the MIRAX reader that allows attackers to read past the slide_positions array via crafted Slidedat.ini values. Attackers can supply a MIRAX slide whose CameraImageDivisionsPerSide does not evenly divide t...

2. CVE-2026-54604 OpenSlide: openslide_read_region() returns uninitialized memory with libtiff 4.7.1

   Published 2026-09-17

   Medium·CVSS 5.3 EPSS 0.53%

   OpenSlide is a C library for reading whole slide image files. Prior to 4.0.1, a behavior change in libtiff 4.7.1 causes the indirect TIFF tile path in src/openslide-decode-tiff.c and _openslide_tiff_read_tile() to request a full-height destination for a partial bottom tile row, a...

3. CVE-2026-48977 OpenSlide: Arbitrary memory write with crafted Ventana BIF file

   Published 2026-09-17

   High·CVSS 7.7 EPSS 0.48%

   OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parse_level0_xml() processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts produce attacker-con...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.