{"id":"CVE-2026-48977","summary":"OpenSlide: Arbitrary memory write with crafted Ventana BIF file","details":"OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parse_level0_xml() processing in src/openslide-vendor-ventana.c accepts nonpositive row or column tile counts from a crafted Ventana BIF file. The invalid counts produce attacker-controlled relative memory offsets and allow arbitrary values to be written at those offsets, affecting all supported platforms and configurations and resulting in a crash or potential arbitrary code execution. This issue is fixed in version 4.0.1.","aliases":["GHSA-mxg2-48g7-fmwc"],"modified":"2026-09-18T11:46:53.602058933Z","published":"2026-09-17T20:26:21.921Z","related":["openSUSE-SU-2026:11707-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-123","CWE-1284","CWE-823"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48977.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48977.json"},{"type":"FIX","url":"https://github.com/openslide/openslide/commit/2be88bd782d9fff46de8e56a99baca523e7917b3"},{"type":"FIX","url":"https://github.com/openslide/openslide/pull/751"},{"type":"WEB","url":"https://github.com/openslide/openslide/releases/tag/v4.0.1"},{"type":"ADVISORY","url":"https://github.com/openslide/openslide/security/advisories/GHSA-mxg2-48g7-fmwc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48977"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openslide/openslide","events":[{"introduced":"4cd4b83c3ffff0382126d0618c85407f2c469b28"},{"fixed":"fe79a9713bef2bfd64bbfefd15704060764b1274"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"3.4.1"},{"fixed":"4.0.1"}]}}],"versions":["v4.0.0","v3.4.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48977.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}