Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-48977

OpenSlide: Arbitrary memory write with crafted Ventana BIF file

CVSS 4.0 7.7 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-48977

Published

OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parse_level0_xml() processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts produce attacker-controlled relative memory offsets and allow arbitrary values to be written at those offsets, affecting all supported platforms and configurations and resulting in a crash or potential arbitrary code execution. This issue is fixed in version 4.0.1.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-48977

Published

openslide

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "openslide",
                    "product": "openslide",
                    "versions": [
                        {
                            "version": ">= 3.4.1, < 4.0.1",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON