CVE-2026-54604: OpenSlide: openslide_read_region() returns uninitialized memory with libtiff 4.7.1
OpenSlide is a C library for reading whole slide image files. Prior to 4.0.1, a behavior change in libtiff 4.7.1 causes the indirect TIFF tile path in src/openslide-decode-tiff.c and openslidetiffreadtile() to request a full-height destination for a partial bottom tile row, allowing uninitialized heap memory to enter pixel data returned by openslidereadregion(). A crafted but valid slide can trigger the issue in TIFF-based formats other than Hamamatsu NDPI when a network service renders attacker-provided slides. Successful extraction depends on pixel transparency handling and recompression, OpenSlide with libtiff 4.7.0 or earlier is not affected, and official binary builds 4.0.0.10 and 4.0.0.11 are affected. This issue is fixed in OpenSlide 4.0.1 and official binary build 4.0.0.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenSlideto a version that resolves this vulnerability.Fixed in 4.0.1 - Upgrade
Upgrade
OpenSlide official binary buildto a version that resolves this vulnerability.Fixed in 4.0.0.12
Event History
Frequently Asked Questions
Which deployments are realistically exposed to data disclosure?
Network services that render attacker-provided TIFF-based slide files are the relevant exposure scenario. Hamamatsu NDPI is excluded from the affected TIFF-based formats, and practical extraction also depends on pixel transparency handling and recompression.
What software combinations are affected?
The issue affects OpenSlide versions before 4.0.1 when used with libtiff 4.7.1. Official OpenSlide binary builds 4.0.0.10 and 4.0.0.11 are affected, while OpenSlide with libtiff 4.7.0 or earlier is not affected.
What should teams do to remediate this issue?
Upgrade to OpenSlide 4.0.1 or official binary build 4.0.0.12. If an immediate upgrade is not possible, avoid rendering attacker-provided TIFF-based slides in network-accessible services; using libtiff 4.7.0 or earlier is identified as unaffected.