CVE-2019-5063

Vulnerability

Overview

CVE-2019-5063 is a heap buffer overflow vulnerability in the data structure persistence functionality of OpenCV 4.1.0. The flaw resides in the XML parsing routine within persistence_xml.cpp, where a fixed-size buffer of 4112 bytes (CV_FS_MAX_LEN+16) is used to store character entity references. When an ampersand (&) is encountered, the parser reads alphanumeric characters until a semicolon; if the entity name does not match known strings, the raw data is copied into the buffer without proper bounds checking, leading to a heap overflow [2].

Exploitation

An attacker can trigger the vulnerability by providing a specially crafted XML file that contains an overly long or malformed character entity reference. The attack requires user interaction (e.g., opening the file with an application using OpenCV's persistence module) but no authentication or special network access. The CVSSv3 score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting the low complexity and high impact [2][3].

Impact

Successful exploitation results in heap corruption, which can be leveraged to achieve arbitrary code execution in the context of the process using OpenCV. This could allow an attacker to compromise systems that rely on OpenCV for processing untrusted XML data, such as in image analysis pipelines or robotics applications [2].

Mitigation

The vulnerability was addressed in OpenCV versions after 4.1.0. Users should update to a patched release, such as opencv-python 4.1.0.25 or later [4]. No workarounds are documented; avoiding the parsing of untrusted XML files is recommended until an update can be applied.