CVE-2026-54604 openslide CVE debrief

Who should care

Defenders who use OpenSlide with libtiff 4.7.0 or earlier should assess their exposure to this vulnerability. They should prioritize updating OpenSlide to version 4.0.1 or later, and applying the official patches.

Why it matters

CVE-2026-54604 is a vulnerability in OpenSlide that allows uninitialized heap memory to enter pixel data returned by openslide_read_region(). Defenders should prioritize updating OpenSlide to version 4.0.1 or later, and applying the official patches. They should also assess their exposure to this vulnerability, particularly if they use OpenSlide with libtiff 4.7.0 or earlier. The vulnerability can be triggered by a crafted but valid slide in TIFF-based formats other than Hamamatsu NDPI when a network service renders attacker-provided slides.

• Defenders need to verify pixel transparency handling and recompression to prevent potential issues.
• Successful extraction of pixel data depends on pixel transparency handling and recompression.
• Defenders should assess their exposure to this vulnerability, particularly if they use OpenSlide with libtiff 4.7.0 or earlier.
• Remediation priority follows from verifying affected versions and applying official patches.

Technical summary

A behavior change in libtiff 4.7.1 causes the indirect TIFF tile path in src/openslide-decode-tiff.c and _openslide_tiff_read_tile() to request a full-height destination for a partial bottom tile row, allowing uninitialized heap memory to enter pixel data returned by openslide_read_region(). This issue can be triggered by a crafted but valid slide in TIFF-based formats other than Hamamatsu NDPI when a network service renders attacker-provided slides. Successful extraction depends on pixel transparency handling and recompression. OpenSlide with libtiff 4.7.0 or earlier is not affected. Official binary builds 4.0.0.10 and 4.0.0.11 are affected. This issue is fixed in OpenSlide 4.0.1 and official binary build 4.0.

Defensive priority

Defenders should prioritize updating OpenSlide to version 4.0.1 or later, and applying the official patches. They should also assess their exposure to this vulnerability, particularly if they use OpenSlide with libtiff 4.7.0 or earlier.

Recommended defensive actions

• Update OpenSlide to version 4.0.1 or later
• Apply official patches
• Assess exposure to this vulnerability, particularly if using OpenSlide with libtiff 4.7.0 or earlier
• Verify pixel transparency handling and recompression
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by a behavior change in libtiff 4.7.1. OpenSlide with libtiff 4.7.0 or earlier is not affected. Official binary builds 4.0.0.10 and 4.0.0.11 are affected. This issue is fixed in OpenSlide 4.0.1 and official binary build 4.0.0.12.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.