CVE-2018-5269

Vulnerability

OpenCV 3.3.1 contains an integer cast bug in the cv::RBaseStream::setPos function within modules/imgcodecs/src/bitstrm.cpp (line 168). Incorrect casting from a int64 to a int32 integer can cause an assertion failure (assert(isOpened() && pos >= 0)) when processing specially crafted image files [4]. The assertion check relies on a signed 32-bit value, but the underlying stream position can exceed the 32-bit range, leading to undefined behavior when truncated [2]. The vulnerability affects the imgcodecs module and is reachable when OpenCV attempts to decode a malicious image file.

Exploitation

An attacker can exploit this vulnerability by providing a crafted image file (e.g., PNG, JPEG, or other formats handled by OpenCV) that causes the internal stream position to overflow or become negative after integer truncation [4]. No authentication or special network position is required if the victim application loads the file from an untrusted source (e.g., user upload, website content). The attacker only needs to supply the crafted file to trigger the assertion failure during decoding.

Impact

Successful exploitation results in a denial of service (DoS) condition: the OpenCV process crashes due to the failed assertion, terminating the application [1][4]. There is no memory corruption or arbitrary code execution reported, but the crash can be used to disrupt services that rely on OpenCV for image processing. The impact is limited to availability loss.

Mitigation

The OpenCV project addressed this issue by replacing the assert() call with proper error handling and adding overflow checks in pull request #10563 [2]. The fix was included in OpenCV versions after 3.3.1 (e.g., 3.4.0 and later). Users are advised to upgrade to a patched version. As of late 2018, no known workarounds exist aside from upgrading; users on EOL versions should consider migrating to a supported release.