{"id":"CVE-2019-5063","aliases":["GHSA-m6vm-8g8v-xfjh","PYSEC-2026-2801","PYSEC-2026-2826","PYSEC-2026-2840","PYSEC-2026-724"],"url":"https://o3.security/vulnerability/CVE-2019-5063","summary":"Out-of-bounds Write in OpenCV","details":"An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0 (corresponds with OpenCV-Python 4.1.0.25). A specially crafted XML file can cause a buffer overflow, resulting in multiple heap corruptions and potential code execution. An attacker can provide a specially crafted file to trigger this vulnerability.","published":"2020-01-03T17:15:12.210Z","modified":"2026-10-10T10:45:07.688629772Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"PyPI","name":"opencv-python","fixedVersion":null},{"ecosystem":"PyPI","name":"opencv-python-headless","fixedVersion":null},{"ecosystem":"PyPI","name":"opencv-contrib-python","fixedVersion":null},{"ecosystem":"PyPI","name":"opencv-contrib-python-headless","fixedVersion":null}],"fix":null,"references":[{"type":"FIX","url":"https://www.oracle.com//security-alerts/cpujul2021.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuApr2021.html"},{"type":"EVIDENCE","url":"https://talosintelligence.com/vulnerability_reports/TALOS-2019-0852"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-5063"},{"type":"WEB","url":"https://github.com/opencv/opencv/issues/16951"},{"type":"PACKAGE","url":"https://github.com/opencv/opencv-python"},{"type":"WEB","url":"https://github.com/opencv/opencv-python/releases/tag/25"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-10T10:45:07.688629772Z"}}