OpenSlide, a C library for reading whole slide image files, has a vulnerability in versions prior to 4.0.1 due to a behavior change introduced in libtiff 4.7.1. This change causes the indirect TIFF tile path in src/openslide-decode-tiff.c and the _openslide_tiff_read_tile() function to request a full-height destination for a partial bottom tile row. As a result, uninitialized heap memory can be included in pixel data returned by openslide_read_region(). The vulnerability can be triggered by a crafted but valid slide in TIFF-based formats other than Hamamatsu NDPI when a network service renders attacker-provided slides. The vulnerability does not affect OpenSlide with libtiff 4.7.0 or earlier. Official binary builds 4.0.0.10 and 4.0.0.11 are affected, while the issue is fixed in OpenSlide 4.0.1 and official binary build 4.0.0.12.

The vulnerability allows uninitialized heap memory to be included in pixel data returned by the library, which could lead to information disclosure or data leakage when rendering attacker-controlled slide images. The impact depends on pixel transparency handling and recompression in the consuming application. There is no indication of privilege escalation, remote code execution, or denial of service. No known exploits in the wild have been reported.

This issue is fixed in OpenSlide version 4.0.1 and official binary build 4.0.0.12. Users should upgrade to these versions or later to remediate the vulnerability. No other mitigation or temporary workaround is indicated.