CVE-2017-1000450

Vulnerability

In OpenCV version 3.3 and earlier, the functions FillUniColor and FillUniGray in modules/imgcodecs/src/utils.cpp do not validate the length of input data during image decoding, leading to an integer overflow. This flaw is reachable when the library processes images from untrusted sources, such as remote downloads. Affected versions include all OpenCV releases up to and including 3.3 [1][2][4].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious image file that triggers the integer overflow during decoding. No authentication is required; the victim only needs to process the image (e.g., via cv::imread). The provided proof-of-concept demonstrates that calling cv::imread on a specially crafted file causes an out-of-bounds write, leading to a segmentation fault [3][4].

Impact

Successful exploitation can result in memory corruption, potentially enabling denial of service via application crash. If the image is loaded from a remote source, the attacker may achieve remote code execution, gaining arbitrary control over the affected system [1][2].

Mitigation

OpenCV released fixed versions starting from 3.4. Users should upgrade to OpenCV 3.4 or later. As of the publication date, no workaround is documented for earlier releases; upgrading is the recommended action [1][2][4].