CVE-2026-54604 openslide CVE debrief

Who should care

Defenders responsible for OpenSlide installations, network services rendering slides, and systems using libtiff should assess exposure and prioritize verification and updates. This includes reviewing and updating OpenSlide to version 4.0.1 or later, and monitoring network services for potential exploitation attempts. Additionally, defenders should review compensating controls for exposed systems and track exceptions and retest remediated assets.

Why it matters

CVE-2026-54604 is a vulnerability in OpenSlide, a C library for reading whole slide image files. A behavior change in libtiff 4.7.1 causes the indirect TIFF tile path to request a full-height destination for a partial bottom tile row, allowing uninitialized heap memory to enter pixel data returned by openslide_read_region(). Defenders should prioritize verifying and updating OpenSlide installations to prevent potential exploitation.

• Potential exposure of OpenSlide installations to exploitation attempts
• Need for verification and updates to prevent potential exploitation
• Possible impact on network services rendering slides
• Requirement for review and update of libtiff to version 4.7.0 or earlier if necessary

Technical summary

A behavior change in libtiff 4.7.1 causes the indirect TIFF tile path in src/openslide-decode-tiff.c and _openslide_tiff_read_tile() to request a full-height destination for a partial bottom tile row, allowing uninitialized heap memory to enter pixel data returned by openslide_read_region(). This issue is fixed in OpenSlide 4.0.1 and official binary build 4.0.0.12. The vulnerability affects OpenSlide with libtiff 4.7.1 or later and can be triggered by a crafted but valid slide in TIFF-based formats other than Hamamatsu NDPI.

Defensive priority

Defenders should prioritize verifying and updating OpenSlide installations to prevent potential exploitation.

Recommended defensive actions

• Verify OpenSlide installations and update to version 4.0.1 or later
• Review and update libtiff to version 4.7.0 or earlier if necessary
• Monitor network services rendering slides for potential exploitation attempts
• Perform vulnerability scanning to identify potentially affected systems
• Review system logs for suspicious activity related to OpenSlide
• Implement compensating controls for exposed systems
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and source item provide details on the vulnerability in OpenSlide, a C library for reading whole slide image files. A behavior change in libtiff 4.7.1 causes the indirect TIFF tile path to request a full-height destination for a partial bottom tile row, allowing uninitialized heap memory to enter pixel data returned by openslide_read_region().

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.