CVE-2019-14492: Out-of-bounds Read and Write in OpenCV
Summary
CVE-2019-14492: Out-of-bounds Read and Out-of-bounds Write in OpenCV. Affects opencv-python across 2 version ranges.
< 3.4.7.28
>= 4.0.0.21, < 4.1.1.26
Fixed in 3.4.7.28 or 4.1.1.26, depending on the release line you run. How to fix ↓
Also tracked for
- opencv-contrib-python · PyPI
- opencv-python-headless · PyPI
- opencv-contrib-python-headless · PyPI
- opencv · Debian:11
The same CVE-2019-14492 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV is an open-source computer vision library that provides various functions and algorithms for image and video processing. It is widely used in applications such as object detection, facial recognition, and augmented reality. However, OpenCV versions before 3.4.7 and 4.x before 4.1.1 (OpenCV-Python before 3.4.7.28 and 4.x before 4.1.1.26) are vulnerable to an out-of-bounds read and write issue in the HaarEvaluator::OptFeature::calc function of the cascadedetect.hpp file. This vulnerability can lead to denial of service.
Vulnerability Detail
The vulnerability in OpenCV arises due to an out-of-bounds read and write in the HaarEvaluator::OptFeature::calc function. An attacker can exploit this issue to cause a denial of service. The specific technical details of the vulnerability are as follows:
- Vulnerability ID: GHSA-fw99-f933-rgh8
- CVE ID: CVE-2019-14492
- Severity: High (CVSS score: 7.5)
- CWE IDs: CWE-125, CWE-787
- Affected Packages: opencv-python, opencv-python-headless, opencv-contrib-python, opencv-contrib-python-headless
- Affected Versions: <= 3.4.6.27, <= 4.1.0.25
- Fixed Versions: 3.4.7.28, 4.1.1.26
This vulnerability can be exploited by an attacker to crash the application using OpenCV, potentially leading to a denial of service.
How To Fix
Latest published version: 5.0.0.93 as of 23 Oct 2026
pip install --upgrade "opencv-python==5.0.0.93"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.4.7.283.4.7.28pip install --upgrade "opencv-python==3.4.7.28" -
>= 4.0.0.21, < 4.1.1.264.1.1.26pip install --upgrade "opencv-python==4.1.1.26"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the affected OpenCV packages to the fixed versions as mentioned in the 'how_to_fix' section.
Conclusion
The out-of-bounds read and write vulnerability in OpenCV can be exploited to cause a denial of service. It is crucial to update the affected OpenCV packages to the fixed versions to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for opencv-python →
FAQ
OpenCV is an open-source computer vision library that provides various functions and algorithms for image and video processing.
This vulnerability can lead to a denial of service by crashing the application using OpenCV.
OpenCV versions before 3.4.7 and 4.x before 4.1.1 (OpenCV-Python before 3.4.7.28 and 4.x before 4.1.1.26) are affected.
To fix this vulnerability, update the affected OpenCV packages to the fixed versions mentioned in the 'how_to_fix' section.
There is no known workaround for this vulnerability. Updating to the fixed versions is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for opencv-python.
