CVE-2017-12606: Out-of-bounds Write in OpenCV
Summary
CVE-2017-12606: Out-of-bounds Write in OpenCV. Affects opencv-python versions < 3.3.1.11. Fixed in 3.3.1.11. How to fix ↓
Also tracked for
- opencv-contrib-python · PyPI
- opencv · Debian:11
The same CVE-2017-12606 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV (Open Source Computer Vision Library) is a popular open-source library for computer vision and image processing tasks. It provides various functions and algorithms for image and video analysis. OpenCV-Python and OpenCV-Contrib-Python are Python bindings for OpenCV. These packages allow developers to utilize OpenCV functionality in Python applications. However, OpenCV versions up to 3.3 (including OpenCV-Python and OpenCV-Contrib-Python 3.3.0.9) are vulnerable to an out-of-bounds write error in the FillColorRow4 function in utils.cpp. This vulnerability occurs when reading an image file using the cv::imread function.
Vulnerability Detail
The out-of-bounds write vulnerability in OpenCV can be exploited by an attacker to overwrite memory outside the bounds of an allocated buffer. This can lead to various consequences, including remote code execution, denial of service, or information disclosure. The vulnerability originates from an error in the FillColorRow4 function in utils.cpp, which fails to properly validate image file data. By crafting a malicious image file, an attacker can trigger the out-of-bounds write and potentially execute arbitrary code or crash the application.
How To Fix
Latest published version: 5.0.0.93 as of 23 Oct 2026
pip install --upgrade "opencv-python==5.0.0.93"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.1.11
This is the first release that contains the fix.
pip install --upgrade "opencv-python==3.3.1.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can implement input validation and sanitization when processing image files using OpenCV. This can help mitigate the risk of exploiting the vulnerability. Here is an example of input validation code in Python:
import cv2
def read_image(file_path):
try:
img = cv2.imread(file_path)
# Perform additional validation and processing
# ...
return img
except Exception as e:
print('Error reading image:', str(e))
return None
Conclusion
The out-of-bounds write vulnerability in OpenCV can have severe consequences, including remote code execution and denial of service. It is crucial to update the affected packages to the fixed versions and regularly update the OpenCV library to ensure the latest security patches are applied. Implementing input validation and sanitization when processing image files can provide an additional layer of protection. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for opencv-python →
FAQ
OpenCV is an open-source computer vision library that provides functions and algorithms for image and video analysis. It is widely used in various applications, including robotics, augmented reality, and machine learning.
The vulnerability allows an attacker to trigger an out-of-bounds write, which can lead to remote code execution, denial of service, or information disclosure. It is crucial to update the affected packages to prevent potential exploitation.
To fix the vulnerability, update the OpenCV-Python and OpenCV-Contrib-Python packages to version 3.3.1.11 or later. Regularly updating the OpenCV library is also recommended to stay protected against security vulnerabilities.
Implementing input validation and sanitization when processing image files using OpenCV can help mitigate the risk of exploitation. Ensure that the input image files are properly validated and handle any exceptions or errors that may occur during the processing.
For more information about this vulnerability, you can refer to the GitHub Advisory Database entry: [link to the advisory]
References
Related vulnerabilities
Recent vulnerabilities recorded for opencv-python.
