CVE-2017-12862

HIGH

OpenCV < 3.3.0 - Out-of-bounds Write in PXM Image Decoder

Title source: llm
STIX 2.1

Description

In modules/imgcodecs/src/grfmt_pxm.cpp, the length of buffer AutoBuffer _src is small than expected, which will cause copy buffer overflow later. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 and earlier.

References (4)

Core 4
Core References
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201712-02
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://github.com/opencv/opencv/issues/9370
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html

Scores

CVSS v3 8.8
EPSS 0.0307
EPSS Percentile 86.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (5)
debian/debian_linux 8.0
debian/debian_linux 9.0
opencv/opencv < 3.3.0
pypi/opencv-contrib-python 0 - 3.3.1.11PyPI
pypi/opencv-python 0 - 3.3.1.11PyPI
Published Aug 15, 2017
Tracked Since Feb 18, 2026