Description
OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parse_level0_xml() processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts produce attacker-controlled relative memory offsets and allow arbitrary values to be written at those offsets, affecting all supported platforms and configurations and resulting in a crash or potential arbitrary code execution. This issue is fixed in version 4.0.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openslide | openslide | >= 3.4.1, < 4.0.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openslide | 3.4.1+dfsg-9 | — |
| Debian 13 | openslide | 3.4.1+dfsg-7+deb13u1 | — |
| Debian 12 | openslide | 3.4.1+dfsg-6+deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | openslide | No fix yet | — |
| Ubuntu 26.04 LTS | openslide | No fix yet | — |
| Ubuntu 25.10 | openslide | No fix yet | — |
| Ubuntu 24.04 LTS | openslide | No fix yet | — |
| Ubuntu 22.04 LTS | openslide | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | openslide | No fix yet | — |
| Ubuntu 18.04 LTS | openslide | No fix yet | — |
| Ubuntu 16.04 LTS | openslide | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openslide | 4.0.1-1.1 | openSUSE-SU-2026:11707-1 |
Advisories 1
- openSUSE-SU-2026:11707-1 libopenslide-devel-4.0.1-1.1 on GA media SUSE / openSUSE Security Updates · Sep 8, 2026