GHSA-qr4w-53vh-m672
opencv-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863
GHSA-qr4w-53vh-m672 is a high vulnerability (CVSS 8.6) in opencv-python, published August 30, 2024. No source lists public exploit code. Fixed in opencv-python 4.8.1.78.
- Severity
- 8.6 HighCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.8.1.78opencv-python +1 more
Description
opencv-python versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-python v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Active
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opencv-pythonPyPI | before 4.8.1.78 | 4.8.1.78 |
opencv-pythonPyPI | before 4.8.1.78, plus listed versions 3.4.0.143.4.1.153.4.10.353.4.10.373.4.11.39 Show 45 moreShow less3.4.11.413.4.11.433.4.11.453.4.13.473.4.14.513.4.14.533.4.15.553.4.16.573.4.16.593.4.17.613.4.17.633.4.18.653.4.2.173.4.3.183.4.4.193.4.5.203.4.6.273.4.7.283.4.8.293.4.9.313.4.9.334.0.0.214.0.1.234.0.1.244.1.0.254.1.1.264.1.2.304.2.0.324.2.0.344.3.0.364.3.0.384.4.0.404.4.0.424.4.0.444.4.0.464.5.1.484.5.2.524.5.2.544.5.3.564.5.4.584.5.4.604.5.5.624.5.5.644.6.0.664.7.0.68 | 4.8.1.78 |
What each source reports
GitHub Advisories Score used
opencv-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863
opencv-python versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-python v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2.
- Record
GHSA-qr4w-53vh-m672- CVSS 4.0
- 8.6 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
opencv-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863
opencv-python versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-python v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2.
- Record
GHSA-qr4w-53vh-m672- CVSS 4.0
- 8.6 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
nvd.nist.gov/vuln/detail/CVE-2023-4863
github.com/opencv/opencv/pull/24274
Left out here: 3 versions. The JSON record has them.