CVE-2018-5269: opencv-python Reachable Assertion Vulnerability
Summary
CVE-2018-5269: Reachable Assertion in OpenCV. Affects opencv-python versions < 3.4.1.15. Fixed in 3.4.1.15. How to fix ↓
Also tracked for
- opencv-contrib-python · PyPI
- opencv · Debian:11
The same CVE-2018-5269 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCV is an open-source computer vision and machine learning software library that provides a common infrastructure for computer vision applications. It is widely used for real-time image processing, machine learning, and computer vision tasks. The opencv-python package allows Python developers to utilize OpenCV functionalities seamlessly. However, an assertion failure vulnerability has been identified in version 3.3.1, which can lead to application crashes and potentially expose sensitive data.
Vulnerability Detail
In OpenCV version 3.3.1, an assertion failure occurs in the cv::RBaseStream::setPos function located in modules/imgcodecs/src/bitstrm.cpp. This vulnerability arises due to an incorrect integer cast, which can be exploited by attackers to cause application crashes. The ramifications of this vulnerability include potential denial of service and the risk of exposing sensitive information, as the assertion failure can disrupt normal application operations.
How To Fix
Latest published version: 5.0.0.93 as of 23 Oct 2026
pip install --upgrade "opencv-python==5.0.0.93"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.1.15
This is the first release that contains the fix.
pip install --upgrade "opencv-python==3.4.1.15"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using the specific functionalities that trigger the assertion failure until you can update to the patched version. However, this is not a permanent solution and updating the package is highly recommended.
Conclusion
The CVE-2018-5269 vulnerability in the opencv-python package poses a significant risk due to an assertion failure that can disrupt application functionality. It is crucial to update to the patched version 3.4.1.15 or later to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for opencv-python →
FAQ
CVE-2018-5269 is a vulnerability in the opencv-python package that causes an assertion failure due to an incorrect integer cast.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to application crashes and may expose sensitive data, resulting in a denial of service.
You can update the package by running the command pip install --upgrade opencv-python in your terminal.
The CVSS score of this vulnerability is 5.5, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for opencv-python.
