CVE-2026-111130 in OpenSlide
Summary
by MITRE • 10/15/2026
OpenSlide through 4.0.1 contains a heap out-of-bounds read vulnerability in the MIRAX reader that allows attackers to read past the slide_positions array via crafted Slidedat.ini values. Attackers can supply a MIRAX slide whose CameraImageDivisionsPerSide does not evenly divide the image counts, crashing applications that open it and corrupting tile geometry.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in OpenSlide versions through 4.0.1 represents a critical heap-based out-of-bounds read flaw within the MIRAX file format reader component. This issue stems from an insufficient validation of input parameters during the parsing of Slidedat.ini configuration files associated with MIRAX slide images. Specifically, the application fails to verify that the CameraImageDivisionsPerSide value evenly divides the total image counts before proceeding with memory allocation and array indexing operations. When a crafted MIRAX file is processed where this mathematical relationship does not hold true, the internal logic miscalculates the boundaries of the slide_positions array. Consequently, subsequent read operations attempt to access memory locations beyond the allocated bounds of this array, leading to an out-of-bounds read condition on the heap.
From a technical perspective, this flaw is classified under CWE-125, which denotes Out-of-Bounds Read. The root cause lies in the lack of rigorous boundary checks when calculating indices based on division operations involving user-supplied or file-derived metadata values. In C-based libraries like OpenSlide, such arithmetic errors often result in reading uninitialized memory or sensitive data residing adjacent to the intended buffer. While the immediate manifestation described involves application crashes and corruption of tile geometry, heap out-of-bounds reads can potentially be leveraged for more severe exploits depending on the surrounding memory layout. An attacker could theoretically use this vulnerability to leak information about the host system's memory state, although in many image processing contexts, the primary impact remains denial of service due to segmentation faults or undefined behavior triggered by accessing invalid pointers.
The operational impact of this vulnerability is significant for applications that rely on OpenSlide for digital pathology and whole slide imaging workflows. MIRAX files are commonly used in medical diagnostics, meaning that malicious actors could distribute specially crafted slides designed to crash diagnostic software when opened by pathologists or automated analysis systems. This results in a denial of service against critical healthcare infrastructure. Furthermore, the corruption of tile geometry can lead to incorrect rendering of tissue samples, potentially causing misinterpretation of pathological features if the application does not fail safely but instead proceeds with corrupted data structures. Such scenarios pose risks not only to system stability but also to the integrity of medical diagnoses and research outcomes derived from these images.
Mitigation strategies primarily involve updating OpenSlide to version 4.0.2 or later, where this specific validation logic has been corrected to ensure that division operations are checked for remainder before proceeding with array indexing. In environments where immediate patching is not feasible, administrators should implement strict input filtering at the application layer to reject MIRAX files containing Slidedat.ini entries with mismatched image count divisions. Additionally, deploying runtime protection mechanisms such as Address Sanitizers during development and testing phases can help detect similar heap corruption issues early in the software lifecycle. From a defensive posture perspective, this vulnerability aligns with ATT&CK technique T1059, Command and Scripting Interpreter, if considered within the broader context of exploiting misconfigured parsers to execute arbitrary code, although here it is primarily observed as an exploitation vector for denial of service via memory corruption. Organizations handling digital pathology data must prioritize patch management for image processing libraries to prevent potential disruptions in clinical workflows.