CVE-2017-12864: OpenCV-Python Integer Overflow Vulnerability
Summary
CVE-2017-12864: Integer Overflow or Wraparound in OpenCV. Affects opencv-python versions < 3.3.1.11. Fixed in 3.3.1.11. How to fix ↓
Also tracked for
- opencv-contrib-python · PyPI
- opencv · Debian:11
The same CVE-2017-12864 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV is an open-source computer vision and machine learning software library that provides a common infrastructure for computer vision applications. It is widely used for real-time image processing and computer vision tasks. The library is designed to be efficient and flexible, supporting various programming languages including Python. However, certain versions of OpenCV-Python, specifically 3.3.0.9 and earlier, are vulnerable to an integer overflow issue that can lead to severe security risks.
Vulnerability Detail
The vulnerability arises from the ReadNumber function in the grfmt_pxm.cpp file within the imgcodecs module of OpenCV. This function fails to properly check the input length, which can result in an integer overflow. If an attacker provides a specially crafted image file from a remote source, it may lead to remote code execution or denial of service. This vulnerability affects OpenCV 3.3 and earlier versions, posing a significant risk to applications relying on these versions.
How To Fix
Latest published version: 5.0.0.93 as of 23 Oct 2026
pip install --upgrade "opencv-python==5.0.0.93"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.1.11
This is the first release that contains the fix.
pip install --upgrade "opencv-python==3.3.1.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing images from untrusted or remote sources until the package is updated. Implement input validation to check the integrity and source of image files before processing them.
Conclusion
The CVE-2017-12864 vulnerability in OpenCV-Python poses a significant risk due to the potential for remote code execution and denial of service. It is crucial for users to update to the patched version 3.3.1.11 or later to ensure their applications are secure. Additionally, using tools like Vulert can help monitor for vulnerabilities in real-time.
See every vulnerability recorded for opencv-python →
FAQ
CVE-2017-12864 is a vulnerability in OpenCV that allows for integer overflow, potentially leading to remote code execution or denial of service.
OpenCV versions 3.3.0.9 and earlier are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
If you cannot update the package right away, avoid processing images from untrusted sources and implement input validation as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for opencv-python.
