OpenSlide CVE-2026-111130

Exploitation requires that an application using OpenSlide (through 4.0.1) open an attacker-crafted MIRAX-format slide whose Slidedat.ini CameraImageDivisionsPerSide value does not evenly divide the image counts; this malformed metadata drives the out-of-bounds index into the slide_positions array in the MIRAX get-tile-position path. LIMITING FACTORS: this is NOT remotely triggerable - the attacker must get the malicious .mrxs/Slidedat.ini file opened locally (CVSS UI:P/AV:L), so delivery depends on a user or an automated ingestion pipeline processing untrusted slides. Impact is limited to a small heap over-read (low info disclosure) plus an application crash and in-memory tile-geometry corruption; it does not by itself yield code execution or persistent data modification.

This is a moderate, not top-tier, priority. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H, base 6.9) correctly frames a local, file-parsing bug: an attacker cannot reach the code remotely over a network - a victim (or automated pipeline) must open an attacker-supplied MIRAX slide. The dominant impact is availability (VA:H, application crash / DoS) with only a low confidentiality leak (VC:L) from the heap out-of-bounds read past the slide_positions array; there is no integrity impact (VI:N) beyond in-memory tile-geometry corruption, which is not persistent. No EPSS score was supplied and the CVE is NOT in CISA KEV, so there is no evidence of active or widespread exploitation. The signals are internally consistent - CWE-125 (out-of-bounds read), the description, and the CVSS all agree this is a local, interaction-dependent read/crash rather than remote code execution. A detailed technical write-up (hackmd) and exact vulnerable source lines are public, which lowers the bar to reproduce, but no weaponized exploit or EPSS/KEV signal elevates this to an urgent threat. Net: patch on a normal cadence; treat as higher priority only for systems that ingest untrusted slide files automatically.

An attacker crafts a malicious MIRAX whole-slide image whose Slidedat.ini sets CameraImageDivisionsPerSide so it does not evenly divide the image counts, then delivers it to a pathologist, LIMS, or automated processing pipeline that uses OpenSlide. When the victim opens the slide, the MIRAX reader indexes past the slide_positions array, leaking adjacent heap memory and crashing the application. A public technical write-up and the exact vulnerable source lines are available, lowering reproduction effort, though no packaged exploit is indicated in the input.