CVE-2017-12864

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-08-15 · updated 2026-06-17
Weakness: CWE-190

Description

In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function ReadNumber did not checkout the input length, which lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 and earlier.

Affected products

Debian Linux: 8.0, 9.0
OpenCV 3.0.0: through 3.3.0

References

https://github.com/opencv/opencv/issues/9372
https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
https://security.gentoo.org/glsa/201712-02
https://github.com/opencv/opencv/issues/9372
https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html
https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
https://security.gentoo.org/glsa/201712-02

Get alerted when CVE-2017-12864 or the next vulnerability affects your stack