Critical severity · published Jul 17, 2025
CVE-2025-53644
OpenCV is an Open Source Computer Vision Library
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
OpenCV is an Open Source Computer Vision Library. Versions 4.10.0 and 4.11.0 have an uninitialized pointer variable on stack that may lead to arbitrary heap buffer write when reading crafted JPEG images. Version 4.12.0 fixes the vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Opencv · Opencv
4.10.0 before 4.12.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-53644
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-53644
Patch
https://github.com/opencv/opencv/commit/a39db41390de546d18962ee1278bd6dbb715f466
Issue Tracking
https://github.com/opencv/opencv/issues/27271
Release Notes
https://github.com/opencv/opencv/releases/tag/4.12.0
Exploit
https://securitylab.github.com/advisories/GHSL-2025-057_OpenCV/
More from Opencv
8.8
CVE-2019-5064
An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0
8.8
CVE-2019-5063
An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0
8.8
CVE-2017-1000450
In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniColor and FillUniGray do not check the input length, which can lead to integer overflow
8.8
CVE-2017-12864
In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function ReadNumber did not checkout the input length, which lead to integer overflow
8.8
CVE-2017-12863
In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function PxMDecoder::readData has an integer overflow when calculate src_pitch