CVE-2017-12863: OpenCV-Python Integer Overflow Vulnerability
Summary
CVE-2017-12863: Integer Overflow or Wraparound in OpenCV. Affects opencv-contrib-python versions < 3.3.1.11. Fixed in 3.3.1.11. How to fix ↓
Also tracked for
- opencv-python · PyPI
- opencv-python · PyPI
- opencv · Debian:11
The same CVE-2017-12863 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV is an open-source computer vision and machine learning software library that provides a common infrastructure for computer vision applications. It is widely used for real-time image processing and computer vision tasks. The library includes various modules, including imgcodecs, which handles image file input and output. However, certain versions of OpenCV, specifically 3.3 and earlier, are vulnerable to an integer overflow issue that can lead to severe security risks.
Vulnerability Detail
The vulnerability arises from an integer overflow in the PxMDecoder::readData function within the imgcodecs module of OpenCV. When calculating the src_pitch for images, particularly those sourced from remote locations, this overflow can occur. The consequences of this flaw include potential remote code execution or denial of service, making it critical for users to address this vulnerability promptly.
How To Fix
Latest published version: 5.0.0.93 as of 23 Oct 2026
pip install --upgrade "opencv-contrib-python==5.0.0.93"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.1.11
This is the first release that contains the fix.
pip install --upgrade "opencv-contrib-python==3.3.1.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing images from untrusted or remote sources until the package is updated to a secure version. This will help mitigate the risk of exploitation through this vulnerability.
Conclusion
The CVE-2017-12863 vulnerability in OpenCV poses significant risks, including remote code execution and denial of service. Users are strongly advised to update to version 3.3.1.11 or later to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for opencv-contrib-python →
FAQ
CVE-2017-12863 is a vulnerability in OpenCV that involves an integer overflow in the image decoding process, potentially leading to remote code execution or denial of service.
OpenCV versions 3.3 and earlier are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 8.8, indicating a high severity level.
If you cannot update the package right away, avoid processing images from untrusted sources as a temporary measure to reduce risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for opencv-contrib-python.
