OpenCV

General Information

Field	Value
Package Name	opencv-contrib-python-headless
Manufacturer / Vendor	OpenCV Team (open-source community)
Software Category	Library
Primary Documentation	Documentation, GitHub, PyPI
Programming Language(s)	Python, C++
License	MIT License (packaging), Apache 2.0 (OpenCV library)
Deployed Version(s)	>=4.12.0.88
Most Recent Available Version	4.13.0.90
Last Review Date	2026-01-26

Overview

OpenCV (Open Source Computer Vision Library) is an open-source computer vision and machine learning software library containing over 2,500 optimized algorithms for real-time image and video analysis. The opencv-contrib-python-headless package provides pre-built Python bindings for OpenCV including extra contributed modules, optimized for server environments without GUI dependencies.

Within the medical device software, OpenCV serves as a critical image processing infrastructure component used across multiple architectural layers. It is integrated into:

• Preprocessing pipelines: Image resizing, padding, and format normalization before neural network inference in all AI expert services (clinical condition classification, skin segmentation, image quality assessment)
• Test-time augmentation (TTA): Geometric transformations (rotation, flipping) and contrast enhancement (CLAHE) for robust prediction ensemble strategies in the condition classifier
• Color space management: RGB/BGR channel order conversion for interoperability with different libraries, and YCrCb conversion for luminance-based processing
• Visualization rendering: Contour extraction from segmentation masks, bounding box drawing for detection results, and alpha-blended overlay generation for explainability visualizations
• Object detection infrastructure: Input preparation for YOLO-based detection models

The headless variant was selected specifically for deployment in server/containerized environments (Docker, cloud infrastructure) where no display capabilities are required, reducing the dependency footprint by excluding GUI libraries (Qt, GTK). The library was chosen for its industry-standard status in computer vision, comprehensive algorithm coverage, excellent performance characteristics, native NumPy interoperability, and permissive licensing compatible with commercial medical device software.

Functional Requirements

The following functional capabilities of this SOUP are relied upon by the medical device software.

Requirement ID	Description	Source / Reference
FR-001	Resize images using various interpolation methods (area, linear, cubic)	cv2.resize() with cv2.INTER_AREA, INTER_LINEAR, INTER_CUBIC
FR-002	Convert images between color spaces (RGB/BGR, RGB/YCrCb)	cv2.cvtColor() with color conversion codes
FR-003	Apply Contrast Limited Adaptive Histogram Equalization (CLAHE) to images	cv2.createCLAHE() and clahe.apply()
FR-004	Rotate images by 90, 180, or 270 degrees	cv2.rotate() with rotation codes
FR-005	Flip images horizontally, vertically, or both	cv2.flip() with flip codes
FR-006	Detect and extract contours from binary segmentation masks	cv2.findContours() with retrieval/approximation modes
FR-007	Draw contours on images for visualization	cv2.drawContours()
FR-008	Draw polylines for bounding box visualization	cv2.polylines()
FR-009	Blend images using weighted addition for overlay visualization	cv2.addWeighted()
FR-010	Provide border padding mode constants for image augmentation pipelines	cv2.BORDER_CONSTANT

Performance Requirements

The following performance expectations are relevant to the medical device software.

Requirement ID	Description	Acceptance Criteria
PR-001	Image preprocessing operations shall complete within acceptable inference latency	Operations complete within the overall API timeout
PR-002	Memory usage shall scale predictably with image dimensions	No memory leaks during repeated preprocessing operations
PR-003	Interpolation quality shall preserve diagnostic features during resizing	Visual inspection confirms no artifacts in clinical areas

Hardware Requirements

The following hardware dependencies or constraints are imposed by this SOUP component.

Requirement ID	Description	Notes / Limitations
HR-001	x86-64 or ARM64 processor architecture	Pre-built wheels available for common platforms
HR-002	Sufficient system memory for image pixel data	Memory requirements scale with image resolution and color depth

Software Requirements

The following software dependencies and environmental assumptions are required by this SOUP component.

Requirement ID	Description	Dependency / Version Constraints
SR-001	Python runtime environment	Python >=3.7, <3.14
SR-002	NumPy for array interoperability	NumPy 2.x for Python 3.9+
SR-003	No GUI libraries required (headless variant)	Qt/GTK not bundled or required

Known Anomalies Assessment

This section evaluates publicly reported issues, defects, or security vulnerabilities associated with this SOUP component and their relevance to the medical device software.

Anomaly Reference	Status	Applicable	Rationale	Reviewed At
CVE-2025-53644 (heap buffer write)	Fixed	No	Affects JPEG image parsing in versions 4.10.0-4.11.0; the device deploys >=4.12.0.88 which includes the fix	2026-01-26
VDB-228548 (wechat_qrcode memory leak)	Fixed	No	Affects wechat_qrcode module not used by the device; patch applied in OpenCV 4.8.0+	2026-01-26

OpenCV maintains a responsible security posture with prompt patching of reported vulnerabilities. According to Snyk's vulnerability database, historical vulnerabilities have been addressed in subsequent releases. The CVE Details tracker reports minimal security issues for recent versions.

The device's usage pattern minimizes attack surface exposure:

• Controlled input sources: All image data is received through authenticated API endpoints; no arbitrary file path parsing or user-controlled file format selection
• No affected modules: The device does not use the wechat_qrcode module or other contributed modules with reported vulnerabilities
• Standard operations only: The device uses well-tested core functions (resize, cvtColor, findContours) that have been stable for many OpenCV releases
• No untrusted JPEG parsing: Image decoding is handled primarily by Pillow; OpenCV is used for geometric and color transformations on already-decoded NumPy arrays
• Version management: The minimum version constraint (>=4.12.0.88) ensures the CVE-2025-53644 fix is included in all deployments

Risk Control Measures

The following risk control measures are implemented to mitigate potential security and operational risks associated with this SOUP component:

• Input validation at API boundaries ensures all image data is validated before processing
• Pillow is used for primary image decoding; OpenCV is used for transformations on already-decoded NumPy arrays
• OpenCV usage is limited to transformation and visualization operations on validated data
• Version constraints (>=4.12.0.88) ensure all known security fixes are included
• No use of affected contributed modules (wechat_qrcode, etc.)

Assessment Methodology

The following methodology was used to identify and assess known anomalies:

• Sources consulted: National Vulnerability Database (NVD), CVE Details for OpenCV, Snyk vulnerability database, OpenCVE tracker, Debian Security Tracker, and the OpenCV GitHub repository issue tracker
• Criteria for determining applicability: Vulnerabilities were assessed based on whether the affected functionality (specific modules, file format parsers) is used by the device, whether the input vectors are reachable through the device's API, and whether the deployed version includes applicable fixes

Signature meaning

The signatures for the approval process of this document can be found in the verified commits at the repository for the QMS. As a reference, the team members who are expected to participate in this document and their roles in the approval process, as defined in Annex I Responsibility Matrix of the GP-001, are:

• Author: Team members involved
• Reviewer: JD-003, JD-004
• Approver: JD-001