CVE-2026-48977: OpenSlide: Arbitrary memory write with crafted Ventana BIF file
OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parselevel0xml() processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts produce attacker-controlled relative memory offsets and allow arbitrary values to be written at those offsets, affecting all supported platforms and configurations and resulting in a crash or potential arbitrary code execution. This issue is fixed in version 4.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openslideto a version that resolves this vulnerability.Fixed in 4.0.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any application that uses affected OpenSlide versions to process Ventana BIF files is exposed. The issue affects all supported platforms and configurations.
What does an attacker need to exploit it?
An attacker needs to provide a crafted Ventana BIF file containing nonpositive row or column tile counts. Processing that file can cause a crash or potentially allow arbitrary code execution.
Which versions are affected, and what version fixes the issue?
OpenSlide versions from 3.4.1 until 4.0.1 are affected. The issue is fixed in version 4.0.1.