Memory Read Vulnerability in OpenCV: UNKNOWN READ in PngDecoder
Summary
OSV-2025-525: UNKNOWN READ in std::1::function::__func. Affects opencv versions >= 850b686f8a9a1bbadd975910aee815acaf0d6e50, < 468de9b36740b3355f0d5cd8be2ce28b340df120. Fixed in 468de9b36740b3355f0d5cd8be2ce28b340df120. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenCV is an open-source computer vision and machine learning software library that provides a common infrastructure for computer vision applications. It includes over 2500 optimized algorithms for various tasks, including image processing, object detection, and machine learning. This vulnerability affects the PngDecoder component, which is responsible for decoding PNG images. The vulnerability arises from improper handling of memory, leading to potential crashes and undefined behavior.
Vulnerability Detail
The vulnerability identified as OSV-2025-525 is a memory read issue that occurs in the OpenCV library, specifically within the PngDecoder's compose_frame function. This issue can lead to crashes during image processing, potentially allowing an attacker to exploit the vulnerability to execute arbitrary code or cause denial of service. The crash is triggered by an unknown read operation, which indicates that the code is attempting to access memory that it should not, leading to instability in applications utilizing OpenCV.
How To Fix
Minimum fixed version
468de9b36740b3355f0d5cd8be2ce28b340df120
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the PngDecoder for image processing tasks until the library is updated. If possible, consider using alternative image formats or libraries that do not exhibit this vulnerability.
Conclusion
The OpenCV library has a memory read vulnerability in the PngDecoder component that can lead to application crashes and potential exploitation. It is crucial to update to the patched version to ensure the security and stability of applications using OpenCV. Utilize tools like Vulert to monitor for vulnerabilities in your software.
See every vulnerability recorded for opencv →
FAQ
The vulnerability is a memory read issue that can lead to application crashes and potential exploitation.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner.
The consequences include application crashes and the possibility of arbitrary code execution, which can compromise system security.
Yes, a patched version of OpenCV is available. Update to version 468de9b36740b3355f0d5cd8be2ce28b340df120 to mitigate the issue.
If immediate updating is not possible, consider using alternative image processing methods or libraries until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for opencv.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
