CVE-2017-12864: Integer Overflow or Wraparound in OpenCV-Python
Summary
CVE-2017-12864: Integer Overflow or Wraparound in OpenCV. Affects opencv-python versions < 3.3.1.11. Fixed in 3.3.1.11. How to fix ↓
Also tracked for
- opencv-contrib-python · PyPI
- opencv · Debian:11
The same CVE-2017-12864 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV-Python is a Python wrapper for the OpenCV computer vision library. It provides various functions and modules for image and video processing. OpenCV-Python version 3.3.0.9 and earlier are affected by an integer overflow vulnerability in the 'grfmt_pxm.cpp' file of the 'imgcodecs' module. This vulnerability allows for remote code execution or denial of service if an image from a remote source is processed.
Vulnerability Detail
The vulnerability arises due to the lack of input length validation in the 'ReadNumber' function of 'grfmt_pxm.cpp'. This oversight leads to an integer overflow, potentially resulting in remote code execution or denial of service. The issue affects OpenCV-Python versions 3.3.0.9 and earlier.
How To Fix
Latest published version: 5.0.0.93 as of 23 Oct 2026
pip install --upgrade "opencv-python==5.0.0.93"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.1.11
This is the first release that contains the fix.
pip install --upgrade "opencv-python==3.3.1.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can avoid processing images from untrusted or remote sources until the OpenCV-Python package is updated to a secure version. By limiting image processing to trusted sources, the risk of exploitation can be mitigated.
Conclusion
The integer overflow vulnerability in OpenCV-Python versions 3.3.0.9 and earlier can lead to remote code execution or denial of service. It is crucial to update to a secure version of OpenCV-Python (3.3.1.11 or later) to mitigate the risk. Avoiding image processing from untrusted or remote sources can serve as a temporary workaround. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for opencv-python →
FAQ
OpenCV-Python is a Python wrapper for the OpenCV computer vision library. It provides functions and modules for image and video processing.
The vulnerability allows for potential remote code execution or denial of service if an image from a remote source is processed using OpenCV-Python.
OpenCV-Python versions 3.3.0.9 and earlier are affected by this vulnerability.
To fix the vulnerability, update OpenCV-Python to version 3.3.1.11 or later.
As a workaround, avoid processing images from untrusted or remote sources until the OpenCV-Python package is updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for opencv-python.
