CVE-2019-16249: Out-of-bounds Read in OpenCV
Summary
CVE-2019-16249: Out-of-bounds Read in OpenCV. Affects opencv-python versions < 4.1.2.30. Fixed in 4.1.2.30. How to fix ↓
Also tracked for
- opencv-contrib-python · PyPI
- opencv-python-headless · PyPI
- opencv-contrib-python-headless · PyPI
The same CVE-2019-16249 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV is an open-source computer vision library widely used for image and video processing tasks. It provides a comprehensive set of functions and algorithms for various computer vision applications. However, OpenCV versions up to 4.1.1 are vulnerable to an out-of-bounds read in the 'hal_baseline::v_load' function, specifically when called from 'computeSSDMeanNorm' in 'dis_flow.cpp' module of the 'video' package. This vulnerability can potentially lead to information disclosure or denial of service.
Vulnerability Detail
The vulnerability arises due to improper bounds checking in the 'hal_baseline::v_load' function. An attacker can exploit this flaw by providing specially crafted input, causing the function to read data beyond the allocated memory. This can result in the disclosure of sensitive information or crash the application. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Latest published version: 5.0.0.93 as of 23 Oct 2026
pip install --upgrade "opencv-python==5.0.0.93"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.2.30
This is the first release that contains the fix.
pip install --upgrade "opencv-python==4.1.2.30"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can consider implementing input validation and sanitization techniques to mitigate the risk of exploitation. By ensuring that input data is properly validated and restricted within the expected bounds, the vulnerability can be mitigated. Here's an example of input validation in Python:
import cv2
def process_image(image):
if image.shape[0] > 0 and image.shape[1] > 0:
# Perform image processing operations
...
else:
# Handle invalid input
...
Conclusion
The out-of-bounds read vulnerability in OpenCV can be mitigated by updating the affected packages to version 4.1.2.30 or later. It is crucial to promptly apply the necessary patches to prevent potential information disclosure or denial of service. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for opencv-python →
FAQ
OpenCV is an open-source computer vision library used for image and video processing tasks. It provides a wide range of functions and algorithms for various computer vision applications.
The vulnerability can potentially lead to information disclosure or denial of service. An attacker can exploit the flaw to read sensitive data or crash the application.
To fix the vulnerability, update the affected OpenCV packages to version 4.1.2.30 or later. This update includes the necessary patches to address the issue.
As a temporary workaround, implement input validation and sanitization techniques to mitigate the risk of exploitation. Ensure that input data is properly validated and restricted within the expected bounds.
The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for opencv-python.
