critical
CVE-2025-53644
opencv: OpenCV use after free
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Julia6.6CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (high), Julia (medium).
Description
OpenCV is an Open Source Computer Vision Library. Versions 4.10.0 and 4.11.0 have an uninitialized pointer variable on stack that may lead to arbitrary heap buffer write when reading crafted JPEG images. Version 4.12.0 fixes the vulnerability.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| debian 11 | opencv | 3.2.0+dfsg-1 |
| debian 12 | opencv | 3.2.0+dfsg-1 |
| debian 13 | opencv | 3.2.0+dfsg-1 |
| debian 14 | opencv | 3.2.0+dfsg-1 |
| echo | opencv | 3.2.0+dfsg-1 |
| julia::Julia Ecosystem Security Advisories | OpenCV_jll | 4.13.0+0 |
| rapidfort alpine 3.20 | opencv | 4.12.0-r0 |
| rapidfort alpine 3.21 | opencv | 4.12.0-r0 |
| rapidfort alpine 3.22 | opencv | 4.12.0-r0 |
| rapidfort alpine 3.23 | opencv | 4.12.0-r0 |
| rapidfort alpine 3.24 | opencv | 4.12.0-r0 |
| rapidfort fedora 43 | opencv, opencv-alphamat, opencv-aruco and 59 more | 4.11.0-12.fc43 |
Show all 135 entries from 13 sources
| Source | Package | Fixed in |
|---|---|---|
| debian 11 | opencv | 3.2.0+dfsg-1 |
| debian 12 | opencv | 3.2.0+dfsg-1 |
| debian 13 | opencv | 3.2.0+dfsg-1 |
| debian 14 | opencv | 3.2.0+dfsg-1 |
| echo | opencv | 3.2.0+dfsg-1 |
| julia::Julia Ecosystem Security Advisories | OpenCV_jll | 4.13.0+0 |
| rapidfort alpine 3.20 | opencv | 4.12.0-r0 |
| rapidfort alpine 3.21 | opencv | 4.12.0-r0 |
| rapidfort alpine 3.22 | opencv | 4.12.0-r0 |
| rapidfort alpine 3.23 | opencv | 4.12.0-r0 |
| rapidfort alpine 3.24 | opencv | 4.12.0-r0 |
| rapidfort fedora 43 | opencv | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-alphamat | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-aruco | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-bgsegm | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-bioinspired | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-calib3d | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-ccalib | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-core | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-cvv | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-data | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-datasets | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-devel | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-dnn | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-dnn_objdetect | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-dnn_superres | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-doc | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-dpm | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-face | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-features2d | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-flann | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-freetype | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-fuzzy | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-gapi | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-hdf | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-hfs | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-highgui | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-img_hash | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-imgcodecs | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-imgproc | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-intensity_transform | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-java | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-line_descriptor | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-mcc | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-ml | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-objdetect | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-optflow | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-phase_unwrapping | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-photo | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-plot | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-quality | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-rapid | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-reg | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-rgbd | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-saliency | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-shape | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-signal | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-stereo | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-stitching | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-structured_light | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-superres | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-surface_matching | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-text | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-tracking | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-video | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-videoio | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-videostab | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-viz | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-wechat_qrcode | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-ximgproc | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-xobjdetect | 4.11.0-12.fc43 |
| rapidfort fedora 43 | opencv-xphoto | 4.11.0-12.fc43 |
| rapidfort fedora 43 | python3-opencv | 4.11.0-12.fc43 |
| rapidfort Oracle Linux 10 | opencv | no fix listed |
| rapidfort Oracle Linux 10 | opencv-alphamat | no fix listed |
| rapidfort Oracle Linux 10 | opencv-aruco | no fix listed |
| rapidfort Oracle Linux 10 | opencv-bgsegm | no fix listed |
| rapidfort Oracle Linux 10 | opencv-bioinspired | no fix listed |
| rapidfort Oracle Linux 10 | opencv-calib3d | no fix listed |
| rapidfort Oracle Linux 10 | opencv-ccalib | no fix listed |
| rapidfort Oracle Linux 10 | opencv-core | no fix listed |
| rapidfort Oracle Linux 10 | opencv-cvv | no fix listed |
| rapidfort Oracle Linux 10 | opencv-data | no fix listed |
| rapidfort Oracle Linux 10 | opencv-datasets | no fix listed |
| rapidfort Oracle Linux 10 | opencv-devel | no fix listed |
| rapidfort Oracle Linux 10 | opencv-dnn | no fix listed |
| rapidfort Oracle Linux 10 | opencv-dnn_objdetect | no fix listed |
| rapidfort Oracle Linux 10 | opencv-dnn_superres | no fix listed |
| rapidfort Oracle Linux 10 | opencv-doc | no fix listed |
| rapidfort Oracle Linux 10 | opencv-dpm | no fix listed |
| rapidfort Oracle Linux 10 | opencv-face | no fix listed |
| rapidfort Oracle Linux 10 | opencv-features2d | no fix listed |
| rapidfort Oracle Linux 10 | opencv-flann | no fix listed |
| rapidfort Oracle Linux 10 | opencv-freetype | no fix listed |
| rapidfort Oracle Linux 10 | opencv-fuzzy | no fix listed |
| rapidfort Oracle Linux 10 | opencv-gapi | no fix listed |
| rapidfort Oracle Linux 10 | opencv-hdf | no fix listed |
| rapidfort Oracle Linux 10 | opencv-hfs | no fix listed |
| rapidfort Oracle Linux 10 | opencv-highgui | no fix listed |
| rapidfort Oracle Linux 10 | opencv-img_hash | no fix listed |
| rapidfort Oracle Linux 10 | opencv-imgcodecs | no fix listed |
| rapidfort Oracle Linux 10 | opencv-imgproc | no fix listed |
| rapidfort Oracle Linux 10 | opencv-intensity_transform | no fix listed |
| rapidfort Oracle Linux 10 | opencv-java | no fix listed |
| rapidfort Oracle Linux 10 | opencv-line_descriptor | no fix listed |
| rapidfort Oracle Linux 10 | opencv-mcc | no fix listed |
| rapidfort Oracle Linux 10 | opencv-ml | no fix listed |
| rapidfort Oracle Linux 10 | opencv-objdetect | no fix listed |
| rapidfort Oracle Linux 10 | opencv-optflow | no fix listed |
| rapidfort Oracle Linux 10 | opencv-phase_unwrapping | no fix listed |
| rapidfort Oracle Linux 10 | opencv-photo | no fix listed |
| rapidfort Oracle Linux 10 | opencv-plot | no fix listed |
| rapidfort Oracle Linux 10 | opencv-quality | no fix listed |
| rapidfort Oracle Linux 10 | opencv-rapid | no fix listed |
| rapidfort Oracle Linux 10 | opencv-reg | no fix listed |
| rapidfort Oracle Linux 10 | opencv-rgbd | no fix listed |
| rapidfort Oracle Linux 10 | opencv-saliency | no fix listed |
| rapidfort Oracle Linux 10 | opencv-shape | no fix listed |
| rapidfort Oracle Linux 10 | opencv-signal | no fix listed |
| rapidfort Oracle Linux 10 | opencv-stereo | no fix listed |
| rapidfort Oracle Linux 10 | opencv-stitching | no fix listed |
| rapidfort Oracle Linux 10 | opencv-structured_light | no fix listed |
| rapidfort Oracle Linux 10 | opencv-superres | no fix listed |
| rapidfort Oracle Linux 10 | opencv-surface_matching | no fix listed |
| rapidfort Oracle Linux 10 | opencv-text | no fix listed |
| rapidfort Oracle Linux 10 | opencv-tracking | no fix listed |
| rapidfort Oracle Linux 10 | opencv-video | no fix listed |
| rapidfort Oracle Linux 10 | opencv-videoio | no fix listed |
| rapidfort Oracle Linux 10 | opencv-videostab | no fix listed |
| rapidfort Oracle Linux 10 | opencv-viz | no fix listed |
| rapidfort Oracle Linux 10 | opencv-wechat_qrcode | no fix listed |
| rapidfort Oracle Linux 10 | opencv-ximgproc | no fix listed |
| rapidfort Oracle Linux 10 | opencv-xobjdetect | no fix listed |
| rapidfort Oracle Linux 10 | opencv-xphoto | no fix listed |
| rapidfort Oracle Linux 10 | python3-opencv | no fix listed |
References
- https://access.redhat.com/security/cve/CVE-2025-53644
- https://github.com/opencv/opencv/commit/a39db41390de546d18962ee1278bd6dbb715f466
- https://github.com/opencv/opencv/issues/27271
- https://github.com/opencv/opencv/releases/tag/4.12.0
- https://nvd.nist.gov/vuln/detail/CVE-2025-53644
- https://securitylab.github.com/advisories/GHSL-2025-057_OpenCV/
- https://www.cve.org/CVERecord?id=CVE-2025-53644