A heap out‑of‑bounds read occurs in the MIRAX reader when the CameraImageDivisionsPerSide value does not evenly divide the image counts, allowing a crafted Slidedat.ini file to read past the slide_positions array. The read can corrupt tile geometry and cause the application to crash, but the flaw does not provide direct code execution. The vulnerability is classified as a moderate severity issue and may lead to denial of service or unintended data corruption in affected software.

The OpenSlide library, any version through 4.0.1, is affected. Applications that load MIRAX slides with OpenSlide up to version 4.0.1 are vulnerable unless patched to 4.0.2 or later.

The CVSS score is 6.9 and the EPSS score is below 1 %. The vulnerability is not listed in the CISA KEV catalog. Attackers can supply a malicious MIRAX slide file to any application that uses OpenSlide; if the CameraImageDivisionsPerSide value is improperly set, the application will read past the bounds of the slide_positions array, leading to instability or corrupted output. The attack vector, inferred from the description, is file‑based local or remote where the target application parses untrusted MIRAX files.