{"id":"CVE-2019-5064","aliases":["GHSA-q799-q27x-vp7w","PYSEC-2026-2802","PYSEC-2026-2828","PYSEC-2026-2841","PYSEC-2026-725"],"url":"https://o3.security/vulnerability/CVE-2019-5064","summary":"Out-of-bounds Write in OpenCV","details":"An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0. A specially crafted JSON file can cause a buffer overflow, resulting in multiple heap corruptions and potentially code execution. An attacker can provide a specially crafted file to trigger this vulnerability.","published":"2020-01-03T17:15:12.257Z","modified":"2026-07-13T16:43:03.028044223Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":{"score":0.10704,"percentile":0.95581,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"PyPI","name":"opencv-python","fixedVersion":"4.2.0.32"},{"ecosystem":"PyPI","name":"opencv-python-headless","fixedVersion":"4.2.0.32"},{"ecosystem":"PyPI","name":"opencv-contrib-python","fixedVersion":"4.2.0.32"},{"ecosystem":"PyPI","name":"opencv-contrib-python-headless","fixedVersion":"4.2.0.32"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/opencv/opencv/issues/15857"},{"type":"FIX","url":"https://www.oracle.com//security-alerts/cpujul2021.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuApr2021.html"},{"type":"EVIDENCE","url":"https://talosintelligence.com/vulnerability_reports/TALOS-2019-0853"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-13T16:43:03.028044223Z"}}