VulnerabilityAnalyzed

CVE-2025-53644

Versions 4.10.0 and 4.11.0 have an uninitialized pointer variable on stack that may lead to arbitrary heap buffer write when reading crafted JPEG images.

MEDIUM 6.6EPSS 0.37%

Does this matter?

Lower severity and a low EPSS score (0.37%). Track it; it rarely justifies an emergency change on its own.

Description

OpenCV is an Open Source Computer Vision Library. Versions 4.10.0 and 4.11.0 have an uninitialized pointer variable on stack that may lead to arbitrary heap buffer write when reading crafted JPEG images. Version 4.12.0 fixes the vulnerability.

CVSS 4.0: 6.6 MEDIUMCVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.37% probability · 31th percentile
CISA KEV: Not listed
Weakness: CWE-457
Affected: opencv/opencv
Source: security-advisories@github.com

References

https://github.com/opencv/opencv/commit/a39db41390de546d18962ee1278bd6dbb715f466Patch
https://github.com/opencv/opencv/issues/27271Issue Tracking
https://github.com/opencv/opencv/releases/tag/4.12.0Release Notes
https://securitylab.github.com/advisories/GHSL-2025-057_OpenCV/Exploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.