Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

google/mediapipe

              master @ 173ea4a
            

Fixes

CVEs

MEDIUM

Peak severity

50.0%

Coverage

Highlights

Denial of Service: 5 prior fixes. Scrutinize any change in this area.

mediapipe/calculators/tensor/image_to_tensor_converter_opencv.cc: most-fixed (1 issue). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Denial of Service: Invalid region of interest (ROI) parameters can trigger a native process crash (SIGSEGV) within OpenCV's spatial transformations. Developers must rigorously validate input bounds before passing them to native OpenCV drawing or transformation APIs.

Denial of Service: A race condition in concurrent LLM sessions sharing the same LlmInference instance can result in runtime crashes during response generation. Cross-session operations must enforce strict locking mechanisms.

Denial of Service: Improper Unmanaged reference management in Swift callbacks can leak session context memory on early exits, culminating in out-of-memory crashes. Developers must ensure correct balance of retained and unretained references under all callback branches.