PT-2026-54954
CVE-2026-54604
·
تاريخ النشر
2026-06-20
·
تاريخ التحديث
2026-09-23
الوصف من
CVSS 4.0
5.3
متوسطةالمقاييسAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
OpenSlide versions prior to 4.0.1
OpenSlide official binary builds 4.0.0.10 and 4.0.0.11
Description
A behavior change in libtiff 4.7.1 affects the indirect TIFF tile path in src/openslide-decode-tiff.c and the
openslide tiff read tile() function. This causes the system to request a full-height destination for a partial bottom tile row, which allows uninitialized heap memory to enter pixel data returned by openslide read region(). A crafted but valid slide can trigger this issue in TIFF-based formats, excluding Hamamatsu NDPI, when a network service renders slides provided by an attacker. The success of memory extraction depends on recompression and how pixel transparency is handled.Recommendations
Update to version 4.0.1.
Update official binary builds to version 4.0.0.12.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾