{"id":"CVE-2019-14493","aliases":["GHSA-3448-vrgh-85xr","PYSEC-2026-2795","PYSEC-2026-2806","PYSEC-2026-2834","PYSEC-2026-718"],"title":"NULL Pointer Dereference in OpenCV.","summary":"NULL Pointer Dereference in OpenCV.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"opencv-python","product":"opencv-python","ecosystem":"pip","affected":["opencv-python < 4.1.1.26","opencv-python-headless < 4.1.1.26","opencv-contrib-python < 4.1.1.26","opencv-contrib-python-headless < 4.1.1.26"],"patched":["opencv-python 4.1.1.26","opencv-python-headless 4.1.1.26","opencv-contrib-python 4.1.1.26","opencv-contrib-python-headless 4.1.1.26"],"published":"2021-10-12","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:09.084248313Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-3448-vrgh-85xr","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14493"},{"url":"https://github.com/opencv/opencv/issues/15127"},{"url":"https://github.com/opencv/opencv-python"},{"url":"https://github.com/opencv/opencv/compare/371bba8...ddbd10c"},{"url":"https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html"}],"tags":["osv","pip"],"epss":0.03398,"epssPercentile":0.88308,"ingestedAt":"2026-07-08T18:25:44.666Z","slug":"CVE-2019-14493","body":"## Overview\n\nAn issue was discovered in OpenCV before 4.1.1 (OpenCV-Python before 4.1.1.26). There is a NULL pointer dereference in the function cv::XMLParser::parse at modules/core/src/persistence.cpp.\n\n## Affected packages\n\n- `opencv-python < 4.1.1.26`\n- `opencv-python-headless < 4.1.1.26`\n- `opencv-contrib-python < 4.1.1.26`\n- `opencv-contrib-python-headless < 4.1.1.26`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `opencv-python 4.1.1.26`\n- `opencv-python-headless 4.1.1.26`\n- `opencv-contrib-python 4.1.1.26`\n- `opencv-contrib-python-headless 4.1.1.26`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.7,"exploitation":0,"ransomware":0},"changes":[]}