CVE-2025-53644

OpenCV contains a use after free buffer write due to an uninitialized pointer

6.6 MediumFix available

OpenCV is an Open Source Computer Vision Library. Versions 4.10.0 and 4.11.0 have an uninitialized pointer variable on stack that may lead to arbitrary heap buffer write when reading crafted JPEG images. Version 4.12.0 fixes the vulnerability.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.44%Up 0.4 points since Jul 18, 2025

What each source reports

CVE List Score used 6.6

OpenCV contains a use after free buffer write due to an uninitialized pointer

Record: CVE-2025-53644
CVSS 4.0: 6.6 MediumCVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Weakness: CWE-457
Updated: 2026-11-02

EUVDEUVD-2025-21795 6.6

Record: EUVD-2025-21795
CVSS 4.0: 6.6 MediumCVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Updated: 2026-11-02

NVD 6.6

Record: CVE-2025-53644
CVSS 4.0: 6.6 MediumCVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-457
Updated: 2026-11-02

OSV 6.6

OpenCV contains a use after free buffer write due to an uninitialized pointer

Record: CVE-2025-53644
CVSS 4.0: 6.6 MediumCVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Weakness: CWE-457
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-53644 9.8

Record: DEBIAN-CVE-2025-53644
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVJLSEC-2026-569 6.6

Record: JLSEC-2026-569
CVSS 4.0: 6.6 MediumCVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-53644 6.6

OpenCV is an Open Source Computer Vision Library. Versions prior to 4.12.0 have an uninitialized pointer variable on stack that may lead to arbitrary heap buffer write when reading crafted JPEG images. Version 4.12.0 fixes the vulnerability.

Record: UBUNTU-CVE-2025-53644
CVSS 4.0: 6.6 MediumCVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Updated: 2026-11-02

Affected products

opencv

Affected packages

Affected packages
Package	Affected	Fixed
`opencv` Debian:12	before 3.2.0+dfsg-1	3.2.0+dfsg-1
`opencv` Debian:13	before 3.2.0+dfsg-1	3.2.0+dfsg-1
`opencv` Debian:14	before 3.2.0+dfsg-1	3.2.0+dfsg-1
`OpenCV_jll` Julia	4.10.0+0 up to 4.13.0+0	4.13.0+0

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected
Nov 2, 2026	first indexed	CVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-53644 is a medium vulnerability (CVSS 6.6) in Opencv, published July 17, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in opencv 3.2.0+dfsg-1.