Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-54604— OpenSlide: openslide_read_region() returns uninitialized memory with libtiff 4.7.1

Quick assessment

Affected
openslide openslide
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenSlide 是一个用于读取全幅切片图像文件的 C 语言库。在 4.0.1 版本之前，libtiff 4.7.1 中的行为变化导致 中 的间接 TIFF 瓦片（tile）路径在读取部分底部瓦片行时，会请求一个完整高度的目标缓冲区，使得未初始化的堆内存可能被包含在 返回的像素数据中。 一个精心构造但格式合法的切片文件（非 Hamamatsu NDPI 格式的 TIFF 基类格式）可以在网络服务渲染攻击者提供的切片时触发此问题。成功泄露数据依赖于像素透明度处理和再压缩机制。使用 libtiff 4.7.0 或更早

CVSS 5.3 · Medium EPSS 0.30% · P23

Affected Version Matrix 1

VendorProduct Version RangeStatus
openslide openslide < 4.0.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54604

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OpenSlide: openslide_read_region() returns uninitialized memory with libtiff 4.7.1
Source: CVE Program / CVE List V5
Vulnerability Description
OpenSlide is a C library for reading whole slide image files. Prior to 4.0.1, a behavior change in libtiff 4.7.1 causes the indirect TIFF tile path in src/openslide-decode-tiff.c and _openslide_tiff_read_tile() to request a full-height destination for a partial bottom tile row, allowing uninitialized heap memory to enter pixel data returned by openslide_read_region(). A crafted but valid slide can trigger the issue in TIFF-based formats other than Hamamatsu NDPI when a network service renders attacker-provided slides. Successful extraction depends on pixel transparency handling and recompression, OpenSlide with libtiff 4.7.0 or earlier is not affected, and official binary builds 4.0.0.10 and 4.0.0.11 are affected. This issue is fixed in OpenSlide 4.0.1 and official binary build 4.0.0.12.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
依赖未定义、未指明或实现定义的行为
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
openslide openslide < 4.0.1 -

II. Public POCs for CVE-2026-54604

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54604

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54604 (3)

Vendor Advisories for CVE-2026-54604 (2)

Vendor Pages for CVE-2026-54604 (1)

Other References for CVE-2026-54604 (1)

IV. Related Vulnerabilities

Same product: openslide
Same vendor: openslide
Same weakness: CWE-758

V. Comments for CVE-2026-54604

No comments yet

Leave a comment