CVE-2023-2617: opencv NULL Pointer Dereference
Vulnerability summary
CVE-2023-2617 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in opencv. EPSS estimates a 1.36% chance of exploitation in the next 30 days, higher than 71.2% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 10-05-2023PublishedVulnerability first disclosed.
- 27-01-2025Last modifiedVulnerability information updated.
Description
A vulnerability classified as problematic was found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this vulnerability is the function DecodedBitStreamParser::decodeByteSegment of the file qrcode/decoder/decoded_bit_stream_parser.cpp. The manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-228547.
CVSS metrics
7 scores · 4 sources · 3 versions- CVE.orgCNA5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST5.0MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
EPSS trend
Probability
1.36%
Chance of exploitation in the next 30 days
Percentile
71%
Versus all other CVEs
30-day change
0.00 pp
From 1.36% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 found3Ca70A8Af2F5830711E9Cccc73Fb5270
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Opencv2 products
- opencv≥ 4.5.2, ≤ 4.7.0
- wechat_qrcode module4.0 | 4.1 | 4.2 | 4.3 | 4.4 | 4.5 | 4.6 | 4.7
Debian1 product
- opencv< 4.6.0+dfsg-12
Ubuntu1 product
- opencv< 4.5.4+dfsg-9ubuntu4+esm1
3 vendors · 4 products
