CVE-2017-12862: Improper Restriction of Operations within the Bounds of a Memory Buffer in OpenCV
Summary
CVE-2017-12862: Improper Restriction of Operations within the Bounds of a Memory Buffer in OpenCV. Affects opencv-python versions < 3.3.1.11. Fixed in 3.3.1.11. How to fix ↓
Also tracked for
- opencv-contrib-python · PyPI
- opencv · Debian:11
The same CVE-2017-12862 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV is an open-source computer vision and machine learning software library. It provides a wide range of functions and algorithms for image and video processing. OpenCV-Python is a Python wrapper for OpenCV, allowing developers to use OpenCV functionalities in Python applications. However, OpenCV versions 3.3 and earlier are vulnerable to an improper restriction of operations within the bounds of a memory buffer.
Vulnerability Detail
The vulnerability exists in the 'grfmt_pxm.cpp' file in the 'imgcodecs' module of OpenCV. The length of the buffer '_src' is smaller than expected, leading to a buffer overflow when copying data. If an image is obtained from a remote source, this vulnerability can be exploited to achieve remote code execution or cause a denial of service. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: 5.0.0.93 as of 23 Oct 2026
pip install --upgrade "opencv-python==5.0.0.93"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.1.11
This is the first release that contains the fix.
pip install --upgrade "opencv-python==3.3.1.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the packages is not immediately feasible, users can mitigate the risk by avoiding the use of OpenCV functions that process images from untrusted remote sources. By limiting the usage to local images or trusted sources, the potential for remote code execution or denial of service can be reduced.
Conclusion
The vulnerability in OpenCV versions 3.3 and earlier can result in remote code execution or denial of service. It is crucial to update the affected packages to version 3.3.1.11 or later to mitigate the risk. If immediate updates are not feasible, users should limit the usage of OpenCV functions with images from untrusted remote sources. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for opencv-python →
FAQ
OpenCV is an open-source computer vision and machine learning software library that provides functions and algorithms for image and video processing.
The vulnerability can lead to remote code execution or denial of service if an image from a remote source is processed using the affected OpenCV versions.
OpenCV versions 3.3 and earlier are affected by this vulnerability.
To fix the vulnerability, update the OpenCV packages to version 3.3.1.11 or later.
If immediate package updates are not possible, users can mitigate the risk by avoiding the use of OpenCV functions with images from untrusted remote sources.
References
Related vulnerabilities
Recent vulnerabilities recorded for opencv-python.
