GHSA-qr4w-53vh-m672: 
Python vulnerability analysis and mitigation

The vulnerability (GHSA-qr4w-53vh-m672) affects opencv-python versions before v4.8.1.78, which bundled libwebp binaries in wheels that were vulnerable to CVE-2023-4863. This high-severity vulnerability was discovered in August 2024 and affects all versions of opencv-python from version 0 up to (excluding) 4.8.1.78 (GitHub Advisory).

The vulnerability is rated as High severity with a CVSS score of 8.6. It involves a heap buffer overflow in libwebp that could allow remote attackers to perform an out-of-bounds memory write via a crafted HTML page. The vulnerability affects the bundled libwebp binaries in opencv-python wheels (GitHub Advisory, NVD).

The vulnerability could allow attackers to execute arbitrary code through out-of-bounds memory writes, potentially leading to system compromise. The high CVSS score of 8.6 indicates significant potential impact on system confidentiality, integrity, and availability (GitHub Advisory).

The vulnerability has been patched in opencv-python version 4.8.1.78, which upgrades the bundled libwebp binary to v1.3.2. Users are strongly advised to upgrade to this version or later to mitigate the vulnerability (GitHub Advisory).