Is opencv-python safe ? 31 known vulnerabilities, worst severity HIGH.
// reach 1 direct dependencies
1 carry known advisories, worst CRITICAL
167 packages depend on it
an advisory here reaches each of them
// ai models 16 published models carry an advisory from this package
1 pin a version the advisory is confirmed against; the rest declare it without a version.
16 published models
5 declared · 15 observed · 1 inferred
Model Evidence akhilaaa3/Jev-Omni observed BAAI/Brainmu-Spike observed C-Tianyu/NanoJev observed interfaze-ai/interfaze-1-lite observed MonsterMMORPG/Wan_GGUF observed morsetechlab/yolov11-license-plate-detection inferred
16 published AI models are associated with this package: 5 name it in a requirements or pyproject file, 15 load it or import it directly, and 1 are inferred from the runtime stack their declared library pulls in. Only 1 state a version requirement, so this is not a count of affected models.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-qr4w-53vh-m672, the advisory selected below
// 31 advisories GHSA-qr4w-53vh-m672 opencv-python versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-python v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2. HIGH GHSA-q799-q27x-vp7w An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, version 4.1.0 (corresponds with OpenCV-Python version 4.1.2.30). A specially crafted JSON file can cause a buffer overflow, resulting in multiple heap corruptions and potentially code execution. An attacker can provide a specially crafted file to trigger this vulnerability. HIGH GHSA-fw99-f933-rgh8 An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1 (OpenCV-Python before 3.4.7.28 and 4.x before 4.1.1.26). There is an out of bounds read/write in the function HaarEvaluator::OptFeature::calc in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service. HIGH GHSA-8849-5h85-98qw In opencv calls that use libpng, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges required. User interaction is not required for exploitation. Product: AndroidVersions: Android-10Android ID: A-110986616 HIGH GHSA-w96g-3p64-63wr OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python 3.3.0.9) has a buffer overflow in the cv::BmpDecoder::readData function in modules/imgcodecs/src/grfmt_bmp.cpp when reading an image file by using cv::imread, as demonstrated by the 4-buf-overflow-readData-memcpy test case. HIGH GHSA-33h2-69j3-r336 OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python 3.3.0.9) has an out-of-bounds read error in the cv::RBaseStream::readBlock function in modules/imgcodecs/src/bitstrm.cpp when reading an image file by using cv::imread, as demonstrated by the 8-opencv-invalid-read-fread test case. HIGH GHSA-cvhw-2593-5j2q OpenCV 3.0.0 has a double free issue that allows attackers to execute arbitrary code. This issue was fixed in OpenCV version 3.3.1 (corresponding to OpenCV-Python and and OpenCV-Contrib-Python 3.3.1.11). HIGH GHSA-267x-w5hx-8hjr In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function ReadNumber did not checkout the input length, which lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects OpenCV 3.3 (corresponding with OpenCV-Python version 3.3.0.9) and earlier. HIGH GHSA-c7gp-2pch-qh2v OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python and OpenCV-Contrib-Python 3.3.0.9) has an out-of-bounds write error in the FillUniColor function in utils.cpp when reading an image file by using cv::imread. HIGH GHSA-rqxg-xvcq-3v2f OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python and OpenCV-Contrib-Python 3.3.0.9) has an out-of-bounds write error in the FillColorRow8 function in utils.cpp when reading an image file by using cv::imread. HIGH Show all 31 advisories
GHSA-qr4w-53vh-m672 HIGH GitHub rating opencv-python versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-python v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2.
// cvss v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability High Checked 2026-11-06 at 21:46 UTC. The most recent advisory here was published 2024-08-30. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page