CVE-2019-14491: Out-of-bounds Read in OpenCV
Summary
CVE-2019-14491: Out-of-bounds Read in OpenCV. Affects opencv-python across 2 version ranges.
< 3.4.7.28
>= 4.0.0.21, < 4.1.1.26
Fixed in 3.4.7.28 or 4.1.1.26, depending on the release line you run. How to fix ↓
Also tracked for
- opencv-contrib-python · PyPI
- opencv-python-headless · PyPI
- opencv-contrib-python-headless · PyPI
- opencv · Debian:11
The same CVE-2019-14491 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV is an open-source computer vision library that provides a wide range of functions and algorithms for image and video processing. It is widely used in various applications, including robotics, augmented reality, and surveillance systems. However, OpenCV versions before 3.4.7 and 4.x before 4.1.1 (OpenCV-Python before 3.4.7.28 and 4.x before 4.1.1.26) are vulnerable to an out-of-bounds read issue in the cv::predictOrderedcv::HaarEvaluator function in the cascadedetect.hpp file. This vulnerability can be exploited to cause a denial of service.
Vulnerability Detail
The out-of-bounds read vulnerability in OpenCV can be triggered by providing specially crafted input to the cv::predictOrderedcv::HaarEvaluator function. This can lead to the function accessing memory outside the bounds of the allocated buffer, resulting in a crash or potential information disclosure. An attacker could exploit this vulnerability to cause a denial of service by crashing the application or potentially obtain sensitive information from the memory. The vulnerability has a CVSS score of 8.2, indicating a high severity level.
How To Fix
Latest published version: 5.0.0.93 as of 23 Oct 2026
pip install --upgrade "opencv-python==5.0.0.93"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.4.7.283.4.7.28pip install --upgrade "opencv-python==3.4.7.28" -
>= 4.0.0.21, < 4.1.1.264.1.1.26pip install --upgrade "opencv-python==4.1.1.26"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patches or update to the latest version of OpenCV to mitigate the risk.
Conclusion
The out-of-bounds read vulnerability in OpenCV can have serious consequences, including denial of service and potential information disclosure. It is crucial to update to the latest patched version of OpenCV (3.4.7.28 or 4.1.1.26) to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for opencv-python →
FAQ
OpenCV is an open-source computer vision library that provides functions and algorithms for image and video processing.
Versions before 3.4.7 and 4.x before 4.1.1 are affected, including OpenCV-Python versions before 3.4.7.28 and 4.x before 4.1.1.26.
The vulnerability can lead to a denial of service by crashing the application or potential information disclosure.
Yes, updating to the latest patched version of OpenCV (3.4.7.28 or 4.1.1.26) resolves the issue.
No, there are no known workarounds. It is recommended to update to the patched version of OpenCV.
Related vulnerabilities
Recent vulnerabilities recorded for opencv-python.
