CVE-2026-111130
MediumCVSS 6.1Summary
OpenSlide through 4.0.1 contains a heap out-of-bounds read vulnerability in the MIRAX reader that allows attackers to read past the slide_positions array via crafted Slidedat.ini values. Attackers can supply a MIRAX slide whose CameraImageDivisionsPerSide does not evenly divide the image counts, crashing applications that open it and corrupting tile geometry.
Risk Assessment
Opening a malicious MIRAX slide can crash the application or leak memory data. This affects availability and confidentiality of systems processing pathology images.
Recommendation
Update OpenSlide to a version newer than 4.0.1 once a fix is released and avoid opening untrusted MIRAX slide files.
Other vulnerabilities in OpenSlide
See all- CVE-2026-54604Medium
OpenSlide is a C library for reading whole slide image files. A behavior change in libtiff 4.7.1 causes the indirect TIFF tile path to request a full-height destination for a partial bottom tile row, allowing uninitialized heap memory to enter pixel data returned by openslide_read_region(). A crafted but valid slide can trigger the issue in TIFF-based formats other than Hamamatsu NDPI when a network service renders attacker-provided slides. This issue is fixed in OpenSlide 4.0.1 and official binary build 4.0.0.12.
- CVE-2026-48977High
In OpenSlide from 3.4.1 until 4.0.1, parse_level0_xml() processes a crafted Ventana BIF file accepting nonpositive row or column tile counts. The invalid counts produce attacker-controlled memory offsets and allow arbitrary writes, resulting in a crash or potential arbitrary code execution.
Original NVD description (English source)
OpenSlide through 4.0.1 contains a heap out-of-bounds read vulnerability in the MIRAX reader that allows attackers to read past the slide_positions array via crafted Slidedat.ini values. Attackers can supply a MIRAX slide whose CameraImageDivisionsPerSide does not evenly divide the image counts, crashing applications that open it and corrupting tile geometry.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS