CVE-2025-53644

OpenCV is an Open Source Computer Vision Library. Versions 4.10.0 and 4.11.0 have an uninitialized pointer variable on stack that may lead to arbitrary heap buffer write when reading crafted JPEG images. Version 4.12.0 fixes the vulnerability.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/opencv/opencv/commit/a39db41390de546d18962ee1278bd6dbb715f466	Patch
https://github.com/opencv/opencv/issues/27271	Issue Tracking
https://github.com/opencv/opencv/releases/tag/4.12.0	Release Notes
https://securitylab.github.com/advisories/GHSL-2025-057_OpenCV/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:opencv:opencv:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-07-17 18:15

Updated : 2025-10-17 19:18

NVD link : CVE-2025-53644

Mitre link : CVE-2025-53644

CVE.ORG link : CVE-2025-53644

JSON object : View

Products Affected

opencv

opencv

CWE

CWE-457

Use of Uninitialized Variable

{"id": "CVE-2025-53644", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.6, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-07-17T18:15:27.913", "references": [{"url": "https://github.com/opencv/opencv/commit/a39db41390de546d18962ee1278bd6dbb715f466", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/opencv/opencv/issues/27271", "tags": ["Issue Tracking"], "source": "[email protected]"}, {"url": "https://github.com/opencv/opencv/releases/tag/4.12.0", "tags": ["Release Notes"], "source": "[email protected]"}, {"url": "https://securitylab.github.com/advisories/GHSL-2025-057_OpenCV/", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-457"}]}], "descriptions": [{"lang": "en", "value": "OpenCV is an Open Source Computer Vision Library. Versions 4.10.0 and 4.11.0 have an uninitialized pointer variable on stack that may lead to arbitrary heap buffer write when reading crafted JPEG images. Version 4.12.0 fixes the vulnerability."}, {"lang": "es", "value": "OpenCV es una librer\u00eda de c\u00f3digo abierto para visi\u00f3n artificial. Las versiones anteriores a la 4.12.0 tienen una variable de puntero sin inicializar en la pila que puede provocar escrituras arbitrarias en el b\u00fafer del mont\u00f3n al leer im\u00e1genes JPEG manipuladas. La versi\u00f3n 4.12.0 corrige esta vulnerabilidad."}], "lastModified": "2025-10-17T19:18:41.637", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opencv:opencv:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E30EA8AC-6E8E-4818-ACCF-80981D9757C9", "versionEndExcluding": "4.12.0", "versionStartIncluding": "4.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}