Heap Out-of-Bounds Read Vulnerability in OpenSlide Product by OpenSlide
CVE-2026-111130

6.9MEDIUM

Key Information:

Vendor

Openslide

Status
Openslide
Vendor
CVE Published:
15 October 2026

What is CVE-2026-111130?

OpenSlide versions leading up to 4.0.1 are susceptible to a heap out-of-bounds read vulnerability specifically within the MIRAX slide reader. By manipulating the Slidedat.ini file used to store parameters of a MIRAX slide, attackers may exploit this flaw to read beyond the intended memory boundaries. This occurs when the CameraImageDivisionsPerSide parameter fails to properly divide the total number of images, potentially leading to crashes and corruption of tile geometry when applications attempt to process the compromised slides.

Affected Version(s)

openslide 0 <= 4.0.1

References

https://hackmd.io/@haind-pwn/openslide-mirax-slide-positi...
technical-description
https://github.com/openslide/openslide/blob/fe79a9713bef2...
technical-description
https://github.com/openslide/openslide/blob/fe79a9713bef2...
technical-description

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.