CVE-2019-14493: opencv-contrib-python-headless NULL Pointer Dereference Vulnerability
Summary
CVE-2019-14493: NULL Pointer Dereference in OpenCV. Affects opencv-contrib-python-headless versions < 4.1.1.26. Fixed in 4.1.1.26. How to fix ↓
Also tracked for
- opencv-contrib-python · PyPI
- opencv-python · PyPI
- opencv-python-headless · PyPI
- opencv-python · PyPI
- opencv · Debian:11
The same CVE-2019-14493 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenCV is an open-source computer vision and machine learning software library that provides a common infrastructure for computer vision applications. The opencv-contrib-python-headless package is a version of OpenCV that does not include GUI functionalities, making it suitable for server environments where display capabilities are not required. This package is widely used in various applications, including image processing, object detection, and machine learning tasks. However, it is susceptible to a NULL pointer dereference vulnerability that can lead to application crashes.
Vulnerability Detail
An issue was discovered in OpenCV before version 4.1.1, specifically in the opencv-contrib-python-headless package prior to version 4.1.1.26. The vulnerability lies in the function cv::XMLParser::parse located in the modules/core/src/persistence.cpp file. A NULL pointer dereference occurs when the parser encounters unexpected input, which can lead to application crashes and potential denial of service. This vulnerability is classified with a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 5.0.0.93 as of 23 Oct 2026
pip install --upgrade "opencv-contrib-python-headless==5.0.0.93"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.1.26
This is the first release that contains the fix.
pip install --upgrade "opencv-contrib-python-headless==4.1.1.26"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation before passing data to the XML parser to avoid triggering the NULL pointer dereference. However, the best solution is to update to the patched version.
Conclusion
The NULL pointer dereference vulnerability in the opencv-contrib-python-headless package poses a significant risk, leading to application crashes and potential denial of service. It is crucial to update to the patched version 4.1.1.26 or later to mitigate this risk. Regular monitoring and updates are essential for maintaining application security.
See every vulnerability recorded for opencv-contrib-python-headless →
FAQ
A NULL pointer dereference occurs when a program attempts to access memory that has not been allocated, leading to crashes or undefined behavior.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Exploitation of this vulnerability can lead to application crashes and denial of service, impacting the availability of your application.
While the primary risk is application crashes, there is no direct risk of data loss associated with this specific vulnerability.
It is advisable to regularly check for updates and vulnerabilities in your packages, ideally on a monthly basis or whenever a new version is released.
Related vulnerabilities
Recent vulnerabilities recorded for opencv-contrib-python-headless.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
