{"id":"CVE-2019-19624","aliases":["GHSA-jggw-2q6g-c3m6","PYSEC-2026-2800","PYSEC-2026-2824","PYSEC-2026-2839","PYSEC-2026-723"],"title":"Out-of-bounds Read in OpenCV","summary":"Out-of-bounds Read in OpenCV","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","vendor":"opencv-python","product":"opencv-python","ecosystem":"pip","affected":["opencv-python < 4.1.0.25","opencv-python-headless < 4.1.0.25","opencv-contrib-python < 4.1.0.25","opencv-contrib-python-headless < 4.1.0.25"],"patched":["opencv-python 4.1.0.25","opencv-python-headless 4.1.0.25","opencv-contrib-python 4.1.0.25","opencv-contrib-python-headless 4.1.0.25"],"published":"2021-10-12","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:09.240143626Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-jggw-2q6g-c3m6","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19624"},{"url":"https://github.com/opencv/opencv/issues/14554"},{"url":"https://github.com/opencv/opencv/commit/d1615ba11a93062b1429fce9f0f638d1572d3418"},{"url":"https://access.redhat.com/security/cve/cve-2019-19624"},{"url":"https://github.com/opencv/opencv-python"},{"url":"https://github.com/opencv/opencv-python/releases/tag/25"}],"tags":["osv","pip"],"epss":0.01756,"epssPercentile":0.7663,"ingestedAt":"2026-07-08T18:25:50.778Z","slug":"CVE-2019-19624","body":"## Overview\n\nAn out-of-bounds read was discovered in OpenCV before 4.1.1 (OpenCV-Python before 4.1.0.25). Specifically, variable coarsest_scale is assumed to be greater than or equal to finest_scale within the calc()/ocl_calc() functions in dis_flow.cpp. However, this is not true when dealing with small images, leading to an out-of-bounds read of the heap-allocated arrays Ux and Uy.\n\n## Affected packages\n\n- `opencv-python < 4.1.0.25`\n- `opencv-python-headless < 4.1.0.25`\n- `opencv-contrib-python < 4.1.0.25`\n- `opencv-contrib-python-headless < 4.1.0.25`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `opencv-python 4.1.0.25`\n- `opencv-python-headless 4.1.0.25`\n- `opencv-contrib-python 4.1.0.25`\n- `opencv-contrib-python-headless 4.1.0.25`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.4,"exploitation":0,"ransomware":0},"changes":[]}