Is CVE-2026-54604 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54604 being exploited in the wild.

How severe is CVE-2026-54604?

Informational severity, with a CVSS score of 0, published 17 September 2026.

Which products and versions are affected?

OpenSlide 4.0.0.9 through 4.0.0.11, 4.0.0 and 4.0.0.10 (binary builds).

Is there a fix for CVE-2026-54604?

A patch was published on 2026-03-09: Fix merged for openslide-bin Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54604 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54604?

Check whether you run OpenSlide at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54604: OpenSlide uninitialized memory disclosure in TIFF decoding

CVE-2026-54604 · Severity: info · CVSS 0 · Published 2026-09-17

OpenSlide is a C library used by medical imaging software and digital pathology applications to read whole slide image files. A behavior change in the libtiff 4.7.1 library causes OpenSlide to return uninitialized heap memory in pixel data when reading regions near the edges of TIFF-based slides. An attacker could craft a malicious slide file that, when processed by a network service, leaks sensitive data from memory or displays corrupted image data to end users.

Technologies: OpenSlide. Vendors: OpenSlide.

Quick answers

Is CVE-2026-54604 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54604 being exploited in the wild.
How severe is CVE-2026-54604?: Informational severity, with a CVSS score of 0, published 17 September 2026.
Which products and versions are affected?: OpenSlide 4.0.0.9 through 4.0.0.11, 4.0.0 and 4.0.0.10 (binary builds).
Is there a fix for CVE-2026-54604?: A patch was published on 2026-03-09: Fix merged for openslide-bin Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54604 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54604?: Check whether you run OpenSlide at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an information disclosure caused by a regression in libtiff 4.7.1's tile reading behavior. When OpenSlide's TIFF decoder (_openslide_tiff_read_tile() in src/openslide-decode-tiff.c) processes a partial bottom tile row in non-JPEG/non-JP2K TIFF formats, it requests a full-height destination buffer from libtiff, which may contain uninitialized heap memory. This uninitialized data is then returned to callers of openslide_read_region(). The vulnerability affects OpenSlide versions 4.0.0.9 through 4.0.0.11, and depends on libtiff 4.7.1 being in use; libtiff 4.7.0 and earlier do not exhibit the regression. The issue is fixed in OpenSlide 4.0.1 and binary build 4.0.0.12, which work around the libtiff regression.

Affected products

OpenSlide OpenSlide 4.0.0.9 through 4.0.0.11, 4.0.0 and 4.0.0.10 (binary builds)

Timeline

2026-03-05: disclosed: Issue reported on GitHub
2026-03-09: patched: Fix merged for openslide-bin
2026-09-17: patched: OpenSlide 4.0.1 and binary build 4.0.0.12 released with fix
2026-09-17: advisory: CVE-2026-54604 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.