Openslide
Monthly
Memory corruption in OpenSlide's Ventana BIF parser (versions 3.4.1 through 4.0.1) allows a crafted whole-slide image to write attacker-chosen values to attacker-chosen memory offsets, crashing the process that opens the slide or potentially achieving arbitrary code execution. Any application, viewer, or server-side tiling/conversion service that uses the affected library to ingest untrusted Ventana .bif files is exposed, since the defect is not configuration-dependent and affects all supported platforms; exploitation requires a user or process to open the malicious file, and reliable code execution (as opposed to a crash) further depends on controlling heap layout. No public exploit code or confirmed active exploitation was identified at time of analysis, but the underlying write-what-where primitive makes this a high-severity risk for digital-pathology pipelines that accept third-party or uploaded slides.
Uninitialized heap memory disclosure in OpenSlide occurs because libtiff 4.7.1 changed how the indirect TIFF tile read path handles a partial bottom tile row, causing _openslide_tiff_read_tile() to request a full tile-height destination and pull uninitialized heap bytes into pixel data returned by openslide_read_region(). Only OpenSlide 4.0.0.10 and 4.0.0.11 official binary builds - or any OpenSlide build linked against libtiff 4.7.1 or newer - are affected, and exploitation requires a network service that renders attacker-supplied, non-NDPI TIFF-based whole-slide images; OpenSlide linked against libtiff 4.7.0 or earlier is explicitly not affected, and reliability of any actual data extraction depends on downstream pixel transparency handling and recompression, so the practical leak is limited and uncertain. No public exploit code was identified at time of analysis, and the issue is fixed in OpenSlide 4.0.1 and official binary build 4.0.0.12.
Memory corruption in OpenSlide's Ventana BIF parser (versions 3.4.1 through 4.0.1) allows a crafted whole-slide image to write attacker-chosen values to attacker-chosen memory offsets, crashing the process that opens the slide or potentially achieving arbitrary code execution. Any application, viewer, or server-side tiling/conversion service that uses the affected library to ingest untrusted Ventana .bif files is exposed, since the defect is not configuration-dependent and affects all supported platforms; exploitation requires a user or process to open the malicious file, and reliable code execution (as opposed to a crash) further depends on controlling heap layout. No public exploit code or confirmed active exploitation was identified at time of analysis, but the underlying write-what-where primitive makes this a high-severity risk for digital-pathology pipelines that accept third-party or uploaded slides.
Uninitialized heap memory disclosure in OpenSlide occurs because libtiff 4.7.1 changed how the indirect TIFF tile read path handles a partial bottom tile row, causing _openslide_tiff_read_tile() to request a full tile-height destination and pull uninitialized heap bytes into pixel data returned by openslide_read_region(). Only OpenSlide 4.0.0.10 and 4.0.0.11 official binary builds - or any OpenSlide build linked against libtiff 4.7.1 or newer - are affected, and exploitation requires a network service that renders attacker-supplied, non-NDPI TIFF-based whole-slide images; OpenSlide linked against libtiff 4.7.0 or earlier is explicitly not affected, and reliability of any actual data extraction depends on downstream pixel transparency handling and recompression, so the practical leak is limited and uncertain. No public exploit code was identified at time of analysis, and the issue is fixed in OpenSlide 4.0.1 and official binary build 4.0.0.12.