CVE-2019-14493
opencv: NULL pointer dereference in function cv::XMLParser::parse() in persistence_xml.cpp leading to DoS
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · July 23, 2019
Updated · November 22, 2025
Description
A NULL pointer dereference flaw was found in OpenCV in the way the Cascade Classifier algorithm loaded and processed certain classifiers. A remote attacker could exploit this flaw by providing a specially crafted XML file that, when loaded by an application linked to OpenCV, would crash the application causing a denial of service.
Statement
This flaw did not affect the versions of OpenCV as shipped with Red Hat Enterprise Linux 6, 7, and 8 as they did not include the vulnerable code, which was introduced in a newer version of the library.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
Avoid loading cascade classifiers from external untrusted sources.
CVSS / CWE
CVSS 3.1 · 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-476 · NULL Pointer Dereference