CVE-2026-48977
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
In OpenSlide from 3.4.1 until 4.0.1, parse_level0_xml() processes a crafted Ventana BIF file accepting nonpositive row or column tile counts. The invalid counts produce attacker-controlled memory offsets and allow arbitrary writes, resulting in a crash or potential arbitrary code execution.
Risk Assessment
Affects all supported platforms and configurations; can lead to remote code execution or application crash when processing malicious files.
Recommendation
Upgrade OpenSlide to version 4.0.1 or later; until then avoid processing untrusted Ventana BIF files.
Other vulnerabilities in OpenSlide
See all- CVE-2026-111130Medium
OpenSlide through 4.0.1 contains a heap out-of-bounds read vulnerability in the MIRAX reader that allows attackers to read past the slide_positions array via crafted Slidedat.ini values. Attackers can supply a MIRAX slide whose CameraImageDivisionsPerSide does not evenly divide the image counts, crashing applications that open it and corrupting tile geometry.
- CVE-2026-54604Medium
OpenSlide is a C library for reading whole slide image files. A behavior change in libtiff 4.7.1 causes the indirect TIFF tile path to request a full-height destination for a partial bottom tile row, allowing uninitialized heap memory to enter pixel data returned by openslide_read_region(). A crafted but valid slide can trigger the issue in TIFF-based formats other than Hamamatsu NDPI when a network service renders attacker-provided slides. This issue is fixed in OpenSlide 4.0.1 and official binary build 4.0.0.12.
Original NVD description (English source)
OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parse_level0_xml() processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts produce attacker-controlled relative memory offsets and allow arbitrary values to be written at those offsets, affecting all supported platforms and configurations and resulting in a crash or potential arbitrary code execution. This issue is fixed in version 4.0.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS