CVE-2019-14493: opencv-python-headless NULL Pointer Dereference Vulnerability
Summary
CVE-2019-14493: NULL Pointer Dereference in OpenCV. Affects opencv-python-headless versions < 4.1.1.26. Fixed in 4.1.1.26. How to fix ↓
Also tracked for
- opencv-contrib-python · PyPI
- opencv-python · PyPI
- opencv-contrib-python-headless · PyPI
- opencv-python · PyPI
- opencv · Debian:11
The same CVE-2019-14493 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV is an open-source computer vision and machine learning software library that provides a common infrastructure for computer vision applications. It is widely used for real-time image processing and computer vision tasks. The opencv-python-headless package is a version of OpenCV that does not include GUI functionalities, making it suitable for server environments where display capabilities are not required. However, prior to version 4.1.1.26, this package contained a critical vulnerability that could lead to application crashes due to a NULL pointer dereference.
Vulnerability Detail
An issue was discovered in OpenCV before version 4.1.1 (specifically in opencv-python before 4.1.1.26). The vulnerability arises from a NULL pointer dereference in the function cv::XMLParser::parse located in the modules/core/src/persistence.cpp file. This flaw can cause the application to crash when processing certain XML files, leading to potential denial of service (DoS) conditions. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 5.0.0.93 as of 23 Oct 2026
pip install --upgrade "opencv-python-headless==5.0.0.93"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.1.26
This is the first release that contains the fix.
pip install --upgrade "opencv-python-headless==4.1.1.26"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted XML files that could trigger the NULL pointer dereference. Implement input validation to ensure that only safe and expected XML files are processed by your application.
Conclusion
The NULL pointer dereference vulnerability in opencv-python-headless poses a significant risk to applications using this library. It is crucial to update to the patched version to mitigate potential denial of service attacks. Regular monitoring and validation of input data can further enhance the security of your applications.
See every vulnerability recorded for opencv-python-headless →
FAQ
A NULL pointer dereference occurs when a program attempts to access memory that has not been allocated, leading to crashes or undefined behavior.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Exploiting this vulnerability can lead to application crashes and denial of service, affecting the availability of your application.
While the primary risk is application crash, it is advisable to ensure that proper error handling and data backup mechanisms are in place to prevent data loss.
If an immediate update is not possible, implement input validation and avoid processing untrusted XML files as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for opencv-python-headless.
