A behavior change in libtiff 4.7.1 affects the indirect TIFF tile path in src/openslide-decode-tiff.c and the ` openslide tiff read tile()` function. This causes the system to request a full-height destination for a partial bottom tile row, which allows uninitialized heap memory to enter pixel data returned by `openslide read region()`. A crafted but valid slide can trigger this issue in TIFF-based formats, excluding Hamamatsu NDPI, when a network service renders slides provided by an attacker. The success of memory extraction depends on recompression and how pixel transparency is handled.