CVE-2017-12604: Out-of-bounds Write in OpenCV
Summary
CVE-2017-12604: Out-of-bounds Write in OpenCV. Affects opencv-python versions < 3.3.1.11. Fixed in 3.3.1.11. How to fix ↓
Also tracked for
- opencv-contrib-python · PyPI
- opencv · Debian:11
The same CVE-2017-12604 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV (Open Source Computer Vision Library) is a popular open-source library used for computer vision and machine learning applications. It provides various functions and algorithms for image and video processing, object detection, and more. OpenCV-Python and OpenCV-Contrib-Python are Python bindings for OpenCV. However, OpenCV versions up to 3.3 (including OpenCV-Python and OpenCV-Contrib-Python 3.3.0.9) are vulnerable to an out-of-bounds write error in the FillUniColor function in utils.cpp when reading an image file using cv::imread.
Vulnerability Detail
The vulnerability in OpenCV-Python and OpenCV-Contrib-Python versions up to 3.3.0.9 allows an attacker to trigger an out-of-bounds write error. This can potentially lead to arbitrary code execution or a denial of service (DoS) attack. The issue originates from the FillUniColor function in utils.cpp, which is called when reading an image file using cv::imread. By exploiting this vulnerability, an attacker can manipulate the image file in a way that triggers the out-of-bounds write, potentially leading to the execution of malicious code or crashing the application.
How To Fix
Latest published version: 5.0.0.93 as of 23 Oct 2026
pip install --upgrade "opencv-python==5.0.0.93"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.1.11
This is the first release that contains the fix.
pip install --upgrade "opencv-python==3.3.1.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately feasible, a possible workaround is to avoid using cv::imread to read image files from untrusted sources. Instead, consider using alternative methods or libraries that are not affected by this vulnerability. Here's an example of using the Pillow library to read an image file in Python:
from PIL import Image
image = Image.open('path/to/image.jpg')
image.show()
Conclusion
The out-of-bounds write vulnerability in OpenCV-Python and OpenCV-Contrib-Python versions up to 3.3.0.9 can have severe consequences, including arbitrary code execution or a denial of service attack. It is crucial to upgrade to the fixed version (3.3.1.11 or later) or implement the recommended workarounds to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for opencv-python →
FAQ
OpenCV is an open-source computer vision library that provides functions and algorithms for image and video processing, object detection, and more.
The vulnerability allows an attacker to trigger an out-of-bounds write error, which can potentially lead to arbitrary code execution or a denial of service (DoS) attack.
OpenCV-Python and OpenCV-Contrib-Python versions up to 3.3.0.9 are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to OpenCV-Python and OpenCV-Contrib-Python version 3.3.1.11 or later.
If upgrading to the fixed version is not immediately feasible, you can avoid using cv::imread to read image files from untrusted sources and consider using alternative methods or libraries.
References
Related vulnerabilities
Recent vulnerabilities recorded for opencv-python.
