CVE-2017-12863

HIGH

OpenCV < 3.3.0 - Integer Overflow in PxMDecoder::readData

Title source: llm
STIX 2.1

Description

In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function PxMDecoder::readData has an integer overflow when calculate src_pitch. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 and earlier.

References (4)

Core 4
Core References
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201712-02
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://github.com/opencv/opencv/issues/9371
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html

Scores

CVSS v3 8.8
EPSS 0.0270
EPSS Percentile 84.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-190
Status published
Products (5)
debian/debian_linux 8.0
debian/debian_linux 9.0
opencv/opencv < 3.3.0
pypi/opencv-contrib-python 0 - 3.3.1.11PyPI
pypi/opencv-python 0 - 3.3.1.11PyPI
Published Aug 15, 2017
Tracked Since Feb 18, 2026