# CVE-2026-48977: OpenSlide buffer overflow in Ventana BIF file parsing

Source: https://junglewise.ai/threats/cve-2026-48977-openslide-buffer-overflow-in-ventana-bif-file-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-48977 · Severity: info · CVSS 8.1 · Published 2026-09-17

OpenSlide is a C library used to read medical whole slide images from digital pathology scanners. A crafted Ventana BIF image file can cause the library to write arbitrary values to attacker-controlled memory locations, leading to application crashes or potentially allowing code execution on systems that process untrusted slide images.

Technologies: [OpenSlide](https://junglewise.ai/threats/technologies/openslide). Vendors: [OpenSlide](https://junglewise.ai/threats/vendors/openslide).

## Quick answers

**Is CVE-2026-48977 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48977 being exploited in the wild.

**How severe is CVE-2026-48977?** Informational severity, with a CVSS score of 8.1, published 17 September 2026.

**Which products and versions are affected?** OpenSlide 3.4.1 through 4.0.0.

**Is there a fix for CVE-2026-48977?** A patch was published on 2026-06-06: Fixed in version 4.0.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48977 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48977?** Check whether you run OpenSlide at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

OpenSlide's parse_level0_xml() function in src/openslide-vendor-ventana.c fails to validate tile row and column counts from Ventana BIF files. An attacker can supply nonpositive (zero or negative) tile counts in a malicious BIF file, which are then used to compute relative memory offsets without bounds checking. This allows writing arbitrary values at attacker-controlled memory locations. The vulnerability affects all OpenSlide versions from 3.4.1 through 4.0.0 and is fixed in version 4.0.1. No authentication or user interaction is required beyond opening a malicious image file.

## Affected products

- OpenSlide OpenSlide 3.4.1 through 4.0.0

## Timeline

- 2026-09-17: disclosed
- 2026-06-06: patched: Fixed in version 4.0.1

## References

- [https://github.com/openslide/openslide/commit/2be88bd782d9fff46de8e56a99baca523e7917b3](https://github.com/openslide/openslide/commit/2be88bd782d9fff46de8e56a99baca523e7917b3)
- [https://github.com/openslide/openslide/pull/751](https://github.com/openslide/openslide/pull/751)

## Related threats

- [OpenSlide heap out-of-bounds read in MIRAX reader](https://junglewise.ai/threats/cve-2026-111130-openslide-through-4-0-1-contains-a-heap-out-of-bounds-read)
- [OpenSlide uninitialized memory disclosure in TIFF decoding](https://junglewise.ai/threats/cve-2026-54604-openslide-uninitialized-memory-disclosure-in-tiff-decoding)