{"id":"CVE-2026-48977","aliases":["DEBIAN-CVE-2026-48977","EUVD-2026-82434","GHSA-mxg2-48g7-fmwc","MGASA-2026-0328","UBUNTU-CVE-2026-48977","openSUSE-SU-2026:11707-1"],"status":"published","title":"OpenSlide: Arbitrary memory write with crafted Ventana BIF file","description":"OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parse_level0_xml() processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts produce attacker-controlled relative memory offsets and allow arbitrary values to be written at those offsets, affecting all supported platforms and configurations and resulting in a crash or potential arbitrary code execution. This issue is fixed in version 4.0.1.","severity":{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00476,"percentile":0.41467,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-123","CWE-1284","CWE-823"],"published":"2026-08-10T19:29:27Z","modified":"2026-10-28T11:16:27Z","fixes":[{"ecosystem":"Debian:12","package":"openslide","fixed_in":["3.4.1+dfsg-6+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openslide","fixed_in":["3.4.1+dfsg-7+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openslide","fixed_in":["3.4.1+dfsg-9"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"openslide","fixed_in":["4.0.0-1.1.mga10"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"openslide","fixed_in":["4.0.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"openslide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+dfsg-6+deb12u1"}]}],"versions":["3.4.1+dfsg-6"]},{"source":"osv","ecosystem":"Debian:13","package":"openslide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+dfsg-7+deb13u1"}]}],"versions":["3.4.1+dfsg-7"]},{"source":"osv","ecosystem":"Debian:14","package":"openslide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+dfsg-9"}]}],"versions":["3.4.1+dfsg-7","3.4.1+dfsg-8"]},{"source":"osv","ecosystem":"Mageia:10","package":"openslide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-1.1.mga10"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openslide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openslide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.1+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openslide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.1+dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openslide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.1+dfsg-5","3.4.1+dfsg-5build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openslide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.1+dfsg-6build1","3.4.1+dfsg-7","3.4.1+dfsg-7build1","3.4.1+dfsg-7build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"openslide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.1+dfsg-7build2","3.4.1+dfsg-7build3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openslide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.1+dfsg-7build4","3.4.1+dfsg-9"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openslide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.1+dfsg-7build3","3.4.1+dfsg-7build4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openslide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1-1.1"}]}]}],"products":[{"vendor":"openslide","product":"openslide"}],"references":[{"url":"https://github.com/openslide/openslide/security/advisories/GHSA-mxg2-48g7-fmwc","tags":["x_refsource_CONFIRM","advisory","report"]},{"url":"https://github.com/openslide/openslide/pull/751","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/openslide/openslide/commit/2be88bd782d9fff46de8e56a99baca523e7917b3","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/openslide/openslide/releases/tag/v4.0.1","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48977.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48977","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-48977","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0328.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35719","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2LT3YC2CS4XTDLRWSH72YZE3EJ6BQCTJ/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-48977","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48977","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48977","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-48977","title":"OpenSlide: Arbitrary memory write with crafted Ventana BIF file","description":"OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parse_level0_xml() processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts produce attacker-controlled relative memory offsets and allow arbitrary values to be written at those offsets, affecting all supported platforms and configurations and resulting in a crash or potential arbitrary code execution. This issue is fixed in version 4.0.1.","status":"published","published":"2026-09-17T20:26:21.921Z","modified":"2026-09-18T20:07:13.789Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-123","CWE-823","CWE-1284"],"updated_at":"2026-11-02T13:50:49.872037Z"}],"euvd":[{"id":"EUVD-2026-82434","description":"OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parse_level0_xml() processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts produce attacker-controlled relative memory offsets and allow arbitrary values to be written at those offsets, affecting all supported platforms and configurations and resulting in a crash or potential arbitrary code execution. This issue is fixed in version 4.0.1.","status":"published","published":"2026-09-17T20:26:21Z","modified":"2026-09-18T20:07:13Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:28:06.992666Z"}],"nvd":[{"id":"CVE-2026-48977","description":"OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parse_level0_xml() processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts produce attacker-controlled relative memory offsets and allow arbitrary values to be written at those offsets, affecting all supported platforms and configurations and resulting in a crash or potential arbitrary code execution. This issue is fixed in version 4.0.1.","status":"published","published":"2026-09-17T21:17:13.323Z","modified":"2026-09-23T18:12:04.247Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-123","CWE-823","CWE-1284"],"updated_at":"2026-11-02T14:12:49.70655Z"}],"osv":[{"id":"CVE-2026-48977","title":"OpenSlide: Arbitrary memory write with crafted Ventana BIF file","description":"OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parse_level0_xml() processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts produce attacker-controlled relative memory offsets and allow arbitrary values to be written at those offsets, affecting all supported platforms and configurations and resulting in a crash or potential arbitrary code execution. This issue is fixed in version 4.0.1.","status":"published","published":"2026-09-17T20:26:21.921Z","modified":"2026-10-28T11:16:27.719394582Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-123","CWE-1284","CWE-823"],"updated_at":"2026-11-02T15:45:07.060148Z"},{"id":"DEBIAN-CVE-2026-48977","description":"OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parse_level0_xml() processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts produce attacker-controlled relative memory offsets and allow arbitrary values to be written at those offsets, affecting all supported platforms and configurations and resulting in a crash or potential arbitrary code execution. This issue is fixed in version 4.0.1.","status":"published","published":"2026-09-17T21:17:13.323Z","modified":"2026-09-24T08:47:35.873015644Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:56.444225Z"},{"id":"UBUNTU-CVE-2026-48977","description":"OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parse_level0_xml() processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts produce attacker-controlled relative memory offsets and allow arbitrary values to be written at those offsets, affecting all supported platforms and configurations and resulting in a crash or potential arbitrary code execution. This issue is fixed in version 4.0.1.","status":"published","published":"2026-09-17T21:17:00Z","modified":"2026-10-17T12:56:06.717791923Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"MGASA-2026-0328","title":"Updated openslide packages fix a security vulnerability","description":"Arbitrary memory write with crafted Ventana BIF file. (CVE-2026-48977)\n","status":"published","published":"2026-08-10T19:29:27Z","modified":"2026-08-10T19:30:05.939969739Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11707-1","title":"libopenslide-devel-4.0.1-1.1 on GA media","description":"These are all security issues fixed in the libopenslide-devel-4.0.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-07T00:00:00Z","modified":"2026-09-08T09:00:05.971183449Z","updated_at":"2026-11-02T16:58:39.516824Z"}]}}