CVE-2019-5064

Vulnerability

Analysis

CVE-2019-5064 is a heap buffer overflow vulnerability in the data structure persistence functionality of OpenCV, affecting versions before 4.2.0. The issue resides in the JSON file parsing routine within persistence_json.cpp, where a fixed-size buffer of CV_FS_MAX_LEN+1024 (5120 bytes) is used to copy JSON values. When a null byte is encountered during parsing, the entire value up to that point is copied without a bounds check, allowing an oversized value to overflow the heap-allocated buffer [2].

Exploitation

Conditions

Exploitation requires a user to open a specially crafted JSON file using OpenCV's persistence functionality. No authentication is needed, as the attack vector is local or remote if an application loads user-supplied files over a network. The CVSSv3 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates low attack complexity and user interaction is limited to opening the file [2][3].

Impact

Successful exploitation results in heap corruption, which can be leveraged to achieve arbitrary code execution in the context of the OpenCV process. This could lead to data theft, system compromise, or further lateral movement within a network [1][2].

Mitigation

The vulnerability is fixed in OpenCV version 4.2.0 [4]. Users should upgrade to this or later versions. No known workarounds exist, but limiting the ingestion of untrusted persistence files can reduce risk. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of this writing.