PYSEC-2023-181

opencv-contrib-python versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863.

High Known exploited PyPI

Severity: 8.8 / 10; High · Score from CVE-2023-4863
Exploit chance (EPSS): 99.98%; Chance of exploitation in the next 30 days. Higher than 99.98% of scored vulnerabilities.
Known exploited: Yes; In CISA's catalog
Weakness: —; Not classified
Fix: 4.8.1.78; Upgrade opencv-contrib-python to this version or later

Description

opencv-contrib-python versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-contrib-python v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2.

Affected versions

PyPI

Package	Vulnerable	Fixed in
opencv-contrib-python	`< 4.8.1.78`	`4.8.1.78`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

opencv-contrib-python PyPI → `4.8.1.78`

pip

pip install --upgrade "opencv-contrib-python>=4.8.1.78"

poetry

poetry add "opencv-contrib-python>=4.8.1.78"

uv

uv add "opencv-contrib-python>=4.8.1.78"

References

Advisories

Fixes and patches

github.com/opencv/opencv/pull/24274

Timeline

Sep 29, 2023 Published
Feb 4, 2026 Last updated by the source

Advisory	Severity	Why it's related
GHSA-j7hp-h8jx-5ppr libwebp: OOB write in BuildHuffmanTable	High Known exploited	Linked by the source
GHSA-cxjf-x6jp-p7mc opencv-contrib-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863	High	Also affects opencv-contrib-python
GHSA-9g8h-pjm4-q92p Out-of-bounds Write in OpenCV.	Medium	Also affects opencv-contrib-python
GHSA-q799-q27x-vp7w Out-of-bounds Write in OpenCV	High	Also affects opencv-contrib-python
GHSA-m6vm-8g8v-xfjh Out-of-bounds Write in OpenCV	High	Also affects opencv-contrib-python
GHSA-jggw-2q6g-c3m6 Out-of-bounds Read in OpenCV	Medium	Also affects opencv-contrib-python
GHSA-8849-5h85-98qw Out-of-bounds Write in OpenCV	High	Also affects opencv-contrib-python
GHSA-x3rm-644h-67m8 Out-of-bounds Read in OpenCV	Medium	Also affects opencv-contrib-python

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor