CVE-2026-54604
MEDIUMDescription
OpenSlide is a C library for reading whole slide image files. Prior to 4.0.1, a behavior change in libtiff 4.7.1 causes the indirect TIFF tile path in src/openslide-decode-tiff.c and _openslide_tiff_read_tile() to request a full-height destination for a partial bottom tile row, allowing uninitialized heap memory to enter pixel data returned by openslide_read_region(). A crafted but valid slide can trigger the issue in TIFF-based formats other than Hamamatsu NDPI when a network service renders attacker-provided slides. Successful extraction depends on pixel transparency handling and recompression, OpenSlide with libtiff 4.7.0 or earlier is not affected, and official binary builds 4.0.0.10 and 4.0.0.11 are affected. This issue is fixed in OpenSlide 4.0.1 and official binary build 4.0.0.12.
How to fix
TridentStack Control can deploy fixes like this automatically across your Windows, macOS, and Linux fleet. See how it works
Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.
CVSS v4 Vector
Exploitability
Impact
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploit Intelligence
EPSS data unavailable for this CVE.
References
Related Vulnerabilities
Other CWE-758 vulnerabilities, ordered by exploit likelihood. View all
| CVE | Severity | CVSS | EPSS | Exploited | Fix |
|---|---|---|---|---|---|
| CVE-2026-22858 | Critical | 9.1 | 0.7% | - | Fix |
| CVE-2023-30624 | Low | 3.9 | 0.4% | - | Fix |
| CVE-2026-4705 | Critical | 9.8 | 0.4% | - | Fix |
| CVE-2026-24407 | High | 7.1 | 0.4% | - | Fix |
| CVE-2026-24404 | High | 7.1 | 0.4% | - | Fix |
| CVE-2025-55160 | Medium | 6.1 | 0.4% | - | Fix |
Common questions
How do I fix CVE-2026-54604?
Upgrade openslide on debian unstable to 4.0.1+dfsg-1 or later.
How severe is CVE-2026-54604?
CVE-2026-54604 has a CVSS v4 base score of 5.3, rated medium. CVSS rates the technical impact if the vulnerability is exploited, not how likely that is, so weigh it alongside the exploit-prediction score when you decide what to patch first.
What does CVE-2026-54604 affect?
Published advisories record a fix for openslide (Debian). Only products with a sourced advisory are listed, so treat this as what we can cite rather than a complete inventory.
Embed a live status badge for CVE-2026-54604
Markdown
[](https://tridentstack.com/cve/CVE-2026-54604)HTML
<a href="https://tridentstack.com/cve/CVE-2026-54604"><img src="https://tridentstack.com/cve/badge/CVE-2026-54604.svg" alt="CVE-2026-54604"></a>Check your Linux endpoints for this class of vulnerability
TridentStack Control continuously scans Linux endpoints for known vulnerabilities and deploys the fixes from the same console. 200 endpoints free forever, no credit card.
This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2026-09-17.