CVE-2019-5064

An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, before version 4.2.0. A specially crafted JSON file can cause a buffer overflow, resulting in multiple heap corruptions and potentially code execution. An attacker can provide a specially crafted file to trigger this vulnerability.

This flaw did not affect the versions of OpenCV as shipped with Red Hat Enterprise Linux 6, 7, and 8, as they did not include the vulnerable code, which was introduced in a later version of the library.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid loading OpenCV data structures from external untrusted JSON files.