Heap Memory Exposure in OpenSlide C Library for Whole Slide Images

CVE-2026-54604

What is CVE-2026-54604?

A vulnerability has been discovered in the OpenSlide C library that allows for heap memory exposure due to a change in the behavior of libtiff version 4.7.1. This issue specifically impacts TIFF image handling where a crafted slide can lead to the inclusion of uninitialized heap memory in the pixel data. This situation arises particularly when rendering TIFF-based images from network services, potentially making applications vulnerable when processing malicious slide files. It is important to note that OpenSlide versions prior to 4.0.1, as well as binary builds 4.0.0.10 and 4.0.0.11, are affected, making immediate updates to version 4.0.1 or later essential for user safety.

References