Heap Out-of-Bounds Read in OpenSlide MIRAX Reader

Executive Summary

OpenSlide 4.0.1 has a heap out-of-bounds read flaw in its MIRAX (.mrxs) file parser. When the CameraImageDivisionsPerSide value in Slidedat.ini does not evenly divide image counts, it causes the slide_positions array to be undersized. This leads to an out-of-bounds read when calculating tile positions, potentially crashing applications or corrupting tile geometry.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect MIRAX (.mrxs) files for malformed Slidedat.ini values where CameraImageDivisionsPerSide does not evenly divide IMAGENUMBER_X or IMAGENUMBER_Y. Use OpenSlide tools to parse files and check for crashes or geometry corruption during tile layout processing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to crash applications processing MIRAX files or corrupt internal tile geometry. It requires no authentication and is triggered by opening a specially crafted .mrxs file, potentially disrupting software that relies on OpenSlide for virtual slide image processing.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts data integrity and availability rather than directly violating GDPR or HIPAA. However, it could lead to unauthorized memory access, potentially exposing sensitive data if exploited, which may violate GDPR's data protection principles or HIPAA's integrity requirements. The crash or corruption of tile geometry could also disrupt access to medical or personal data, affecting compliance with availability standards.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update OpenSlide to the latest patched version. If updating is not possible, avoid opening untrusted MIRAX files or implement input validation for CameraImageDivisionsPerSide to ensure it divides image dimensions evenly.

Useful 0 Not Useful 0