Skip to content

CVE-2019-9423

Out-of-bounds Write in OpenCV

7.8 High

In opencv calls that use libpng, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges required. User interaction is not required for exploitation. Product: AndroidVersions: Android-10Android ID: A-110986616

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.29%Down 0.2 points since Apr 14, 2021

What each source reports

NVD Score used 7.8

In opencv calls that use libpng, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges required. User interaction is not required for exploitation. Product: AndroidVersions: Android-10Android ID: A-110986616

Record: CVE-2019-9423
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-787
Updated: 2026-11-02

CVE List No score

In opencv calls that use libpng, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges required. User interaction is not required for exploitation. Product: AndroidVersions: Android-10Android ID: A-110986616

Record: CVE-2019-9423
Updated: 2026-11-02

EUVDEUVD-2021-2177 No score

In opencv calls that use libpng, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges required. User interaction is not required for exploitation. Product: AndroidVersions: Android-10Android ID: A-110986616

Record: EUVD-2021-2177
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8849-5h85-98qw 7.8

Out-of-bounds Write in OpenCV

In opencv calls that use libpng, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges required. User interaction is not required for exploitation. Product: AndroidVersions: Android-10Android ID: A-110986616

Record: GHSA-8849-5h85-98qw
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

OSVGHSA-8849-5h85-98qw 7.8

Out-of-bounds Write in OpenCV

In opencv calls that use libpng, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges required. User interaction is not required for exploitation. Product: AndroidVersions: Android-10Android ID: A-110986616

Record: GHSA-8849-5h85-98qw
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

OSVPYSEC-2026-2796 7.8

Out-of-bounds Write in OpenCV

In opencv calls that use libpng, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges required. User interaction is not required for exploitation. Product: AndroidVersions: Android-10Android ID: A-110986616

Record: PYSEC-2026-2796
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 4 moreShow less

OSVPYSEC-2026-2811 7.8

Out-of-bounds Write in OpenCV

In opencv calls that use libpng, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges required. User interaction is not required for exploitation. Product: AndroidVersions: Android-10Android ID: A-110986616

Record: PYSEC-2026-2811
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVPYSEC-2026-2835 7.8

Out-of-bounds Write in OpenCV

In opencv calls that use libpng, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges required. User interaction is not required for exploitation. Product: AndroidVersions: Android-10Android ID: A-110986616

Record: PYSEC-2026-2835
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVPYSEC-2026-719 7.8

Out-of-bounds Write in OpenCV

In opencv calls that use libpng, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges required. User interaction is not required for exploitation. Product: AndroidVersions: Android-10Android ID: A-110986616

Record: PYSEC-2026-719
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2019-9423 7.8

In opencv calls that use libpng, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges required. User interaction is not required for exploitation. Product: AndroidVersions: Android-10Android ID: A-110986616

Record: UBUNTU-CVE-2019-9423
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

google android

Affected packages

Affected packages
Package	Affected	Fixed
`opencv-python` PyPI	through 4.1.1.26	None known
`opencv-python-headless` PyPI	through 4.1.1.26	None known
`opencv-contrib-python` PyPI	through 4.1.1.26	None known
`opencv-contrib-python-headless` PyPI	through 4.1.1.26	None known
`opencv-python` PyPI	through 4.1.1.26, plus listed versions 3.4.0.143.4.1.153.4.10.353.4.10.373.4.11.39 Show 25 moreShow less 3.4.11.413.4.11.433.4.11.453.4.13.473.4.14.513.4.14.533.4.15.553.4.16.573.4.16.593.4.17.613.4.17.633.4.18.653.4.2.173.4.3.183.4.4.193.4.5.203.4.6.273.4.7.283.4.8.293.4.9.313.4.9.334.0.0.214.0.1.234.0.1.244.1.0.25	None known
`opencv-python-headless` PyPI	through 4.1.1.26, plus listed versions 3.4.10.373.4.11.393.4.11.413.4.11.433.4.11.45 Show 19 moreShow less 3.4.13.473.4.14.513.4.14.533.4.15.553.4.16.573.4.16.593.4.17.613.4.17.633.4.18.653.4.3.183.4.4.193.4.5.203.4.6.273.4.7.283.4.8.293.4.9.334.0.0.214.0.1.244.1.0.25	None known
`opencv-contrib-python` PyPI	through 4.1.1.26, plus listed versions 3.4.10.353.4.10.373.4.11.393.4.11.413.4.11.43 Show 23 moreShow less 3.4.11.453.4.13.473.4.14.513.4.14.533.4.15.553.4.16.573.4.16.593.4.17.613.4.17.633.4.18.653.4.2.173.4.3.183.4.4.193.4.5.203.4.6.273.4.7.283.4.8.293.4.9.313.4.9.334.0.0.214.0.1.234.0.1.244.1.0.25	None known
`opencv-contrib-python-headless` PyPI	through 4.1.1.26, plus listed versions 3.4.0.143.4.10.373.4.11.413.4.11.433.4.11.45 Show 21 moreShow less 3.4.13.473.4.14.513.4.14.533.4.15.553.4.16.573.4.16.593.4.17.613.4.17.633.4.18.653.4.2.173.4.3.183.4.4.193.4.5.203.4.6.273.4.7.283.4.8.293.4.9.334.0.0.214.0.1.234.0.1.244.1.0.25	None known
`opencv-python` PyPI	through 4.1.1.26, plus listed versions 3.4.0.143.4.1.153.4.10.353.4.10.373.4.11.39 Show 26 moreShow less 3.4.11.413.4.11.433.4.11.453.4.13.473.4.14.513.4.14.533.4.15.553.4.16.573.4.16.593.4.17.613.4.17.633.4.18.653.4.2.163.4.2.173.4.3.183.4.4.193.4.5.203.4.6.273.4.7.283.4.8.293.4.9.313.4.9.334.0.0.214.0.1.234.0.1.244.1.0.25	None known
`opencv-contrib-python-headless` PyPI	through 4.1.1.26, plus listed versions 3.4.0.143.4.1.153.4.10.373.4.11.393.4.11.41 Show 23 moreShow less 3.4.11.433.4.11.453.4.13.473.4.14.513.4.14.533.4.15.553.4.16.573.4.16.593.4.17.613.4.17.633.4.18.653.4.2.173.4.3.183.4.4.193.4.5.203.4.6.273.4.7.283.4.8.293.4.9.334.0.0.214.0.1.234.0.1.244.1.0.25	None known

Show 9 moreShow less

Affected packages
Package	Affected	Fixed
`opencv` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 2.4.5+dfsg-0ubuntu42.4.5+dfsg-0ubuntu52.4.6.1+dfsg-2ubuntu22.4.6.1+dfsg-2ubuntu32.4.6.1+dfsg-2ubuntu4 Show 5 moreShow less 2.4.6.1+dfsg-2ubuntu52.4.8+dfsg-1ubuntu12.4.8+dfsg1-2ubuntu12.4.8+dfsg1-2ubuntu1.22.4.8+dfsg1-2ubuntu1.2+esm1	None known
`opencv` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 2.4.9+dfsg-1ubuntu62.4.9.1+dfsg-1.2ubuntu12.4.9.1+dfsg-1.3ubuntu12.4.9.1+dfsg-1.5ubuntu12.4.9.1+dfsg-1.5ubuntu1.12.4.9.1+dfsg-1.5ubuntu1.1+esm1	None known
`opencv` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 3.1.0+dfsg1-1~exp1ubuntu33.2.0+dfsg-33.2.0+dfsg-43.2.0+dfsg-4build13.2.0+dfsg-4build2 Show 4 moreShow less 3.2.0+dfsg-4ubuntu0.13.2.0+dfsg-4ubuntu0.1+esm23.2.0+dfsg-4ubuntu0.1+esm33.2.0+dfsg-4ubuntu0.1+esm4	None known
`opencv` Ubuntu:20.04:LTS	All versions, plus listed versions 3.2.0+dfsg-63.2.0+dfsg-6build13.2.0+dfsg-6build24.1.2+dfsg-4ubuntu34.1.2+dfsg-54.2.0+dfsg-44.2.0+dfsg-5	None known
`opencv` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 4.5.3+dfsg-1ubuntu14.5.4+dfsg-9ubuntu24.5.4+dfsg-9ubuntu44.5.4+dfsg-9ubuntu4+esm1	None known
`opencv` Ubuntu:24.04:LTS	All versions, plus listed versions 4.6.0+dfsg-13build14.6.0+dfsg-13build34.6.0+dfsg-13build54.6.0+dfsg-13.1build24.6.0+dfsg-13.1ubuntu1	None known
`opencv` Ubuntu:25.10	All versions, plus listed versions 4.10.0+dfsg-54.10.0+dfsg-5ubuntu1	None known
`opencv` Ubuntu:26.10	All versions, plus listed versions 4.10.0+dfsg-7ubuntu54.10.0+dfsg-7ubuntu64.10.0+dfsg-8ubuntu14.10.0+dfsg-9ubuntu1	None known
`opencv` Ubuntu:26.04:LTS	All versions, plus listed versions 4.10.0+dfsg-5ubuntu14.10.0+dfsg-6ubuntu44.10.0+dfsg-7ubuntu24.10.0+dfsg-7ubuntu34.10.0+dfsg-7ubuntu44.10.0+dfsg-7ubuntu5	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-9423 is a high vulnerability (CVSS 7.8) in Google Android, published September 27, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. No source names a fixed version.

References

Show 8 moreShow less