GHSA-w2pj-9cgh-mq2c

opencv-contrib-python-headless bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863

8.6 HighFix available

opencv-contrib-python-headless versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-contrib-python-headless v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Active

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

What each source reports

GitHub Advisories Score used8.6

opencv-contrib-python-headless bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863

Record: GHSA-w2pj-9cgh-mq2c
CVSS 4.0: 8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

OSV8.6

opencv-contrib-python-headless bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863

Record: GHSA-w2pj-9cgh-mq2c
CVSS 4.0: 8.6 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`opencv-contrib-python-headless` PyPI	before 4.8.1.78	4.8.1.78
`opencv-contrib-python-headless` PyPI	before 4.8.1.78, plus listed versions 3.4.0.143.4.10.373.4.11.413.4.11.433.4.11.45 Show 44 moreShow less 3.4.13.473.4.14.513.4.14.533.4.15.553.4.16.573.4.16.593.4.17.613.4.17.633.4.18.653.4.2.173.4.3.183.4.4.193.4.5.203.4.6.273.4.7.283.4.8.293.4.9.334.0.0.214.0.1.234.0.1.244.1.0.254.1.1.264.1.2.304.2.0.324.2.0.344.3.0.364.3.0.384.4.0.404.4.0.424.4.0.444.4.0.464.5.1.484.5.2.524.5.2.544.5.3.564.5.4.584.5.4.604.5.5.624.5.5.644.6.0.664.7.0.684.7.0.724.8.0.744.8.0.76	4.8.1.78

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-w2pj-9cgh-mq2c is a high vulnerability (CVSS 8.6) in opencv-contrib-python-headless, published August 30, 2024. No source lists public exploit code. Fixed in opencv-contrib-python-headless 4.8.1.78.