CVE-2017-1000450: Integer Overflow or Wraparound in OpenCV
Summary
CVE-2017-1000450: Integer Overflow or Wraparound in OpenCV. Affects opencv-python versions < 3.3.1.11. Fixed in 3.3.1.11. How to fix ↓
Also tracked for
- opencv-contrib-python · PyPI
- opencv · Debian:11
The same CVE-2017-1000450 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV is an open-source computer vision library that provides various functions and algorithms for image and video processing. It is widely used in applications such as robotics, augmented reality, and surveillance systems. OpenCV-Python is a Python wrapper for OpenCV, allowing developers to utilize OpenCV functionalities in Python applications. However, OpenCV versions 3.3 and earlier are vulnerable to an integer overflow or wraparound issue in the imgcodecs module's utils.cpp file. This vulnerability can be exploited when processing images, potentially leading to remote code execution or denial of service attacks.
Vulnerability Detail
The vulnerability arises from the FillUniColor and FillUniGray functions in the utils.cpp file of the imgcodecs module. These functions fail to validate the input length, which can result in an integer overflow. If an attacker provides a specially crafted image, they can trigger this vulnerability and potentially execute arbitrary code or cause the application to crash. The impact of this vulnerability is particularly severe when processing images from remote sources, as it allows for remote code execution. OpenCV versions 3.3 (including OpenCV-Python 3.3.0.9) and earlier are affected by this vulnerability.
How To Fix
Latest published version: 5.0.0.93 as of 23 Oct 2026
pip install --upgrade "opencv-python==5.0.0.93"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.1.11
This is the first release that contains the fix.
pip install --upgrade "opencv-python==3.3.1.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, if updating to the latest version is not immediately feasible, users can exercise caution when processing images from untrusted sources. It is advisable to thoroughly validate the source and content of the images before processing them with OpenCV.
Conclusion
The integer overflow vulnerability in OpenCV versions 3.3 and earlier poses a significant risk, potentially allowing remote code execution or denial of service attacks. It is crucial to update to the patched version (3.3.1.11 or later) to mitigate this vulnerability. If immediate updating is not possible, exercising caution when processing images from untrusted sources is recommended. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for opencv-python →
FAQ
OpenCV is an open-source computer vision library that provides functions and algorithms for image and video processing.
The vulnerability can lead to remote code execution or denial of service if an attacker provides a specially crafted image.
OpenCV versions 3.3 and earlier, including OpenCV-Python 3.3.0.9, are affected by this vulnerability.
Updating to OpenCV version 3.3.1.11 or later will fix this vulnerability.
As a temporary workaround, exercise caution when processing images from untrusted sources and validate their source and content.
References
Related vulnerabilities
Recent vulnerabilities recorded for opencv-python.
