PT-2017-4336

CVE-2017-1000450

·

Published

2017-09-27

·

Updated

2026-07-09

Description by

CVSS 2.0
9.3
High
MetricsAV:N/AC:M/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions: OpenCV versions 3.3 and earlier
Description: The issue is related to an integer overflow in the utils.cpp component of the OpenCV library, specifically in the FillUniColor and FillUniGray functions. These functions do not check the input length, which can lead to integer overflow. If the image is from a remote source, this could result in remote code execution or denial of service.
Recommendations: For OpenCV versions 3.3 and earlier, consider updating to a newer version that includes a fix for this issue. As a temporary workaround, restrict the use of the FillUniColor and FillUniGray functions in opencv/modules/imgcodecs/src/utils.cpp to minimize the risk of exploitation. Avoid processing images from remote sources until the issue is resolved.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Related identifiers
GHSA-M43C-649M-PM48
DLA-1235-1
DLA-1438-1
DLA-2799-1
OPENSUSE-SU-2018_1438-1
PYSEC-2026-2825
PYSEC-2026-712
Found an issue in the description? Have something to add? Feel free to write us 👾