CVE-2026-102834

Name of the Vulnerable Software and Affected Versions JavaCV versions prior to 1.5.14

Description An issue exists in the IPCameraFrameGrabber class where the Content-Length value from a multipart MJPEG HTTP stream is parsed without bounds checking. A malicious or compromised camera endpoint, or a network attacker capable of tampering with plaintext HTTP responses, can provide a Content-Length value between 1073741825 and 2147483647. This causes a 32-bit signed integer overflow within the ensureBufferCapacity(int) function during the buffer-growth routine. Specifically, the capacity variable wraps to a negative value and then to 0, resulting in an infinite loop that consumes 100% of the CPU. This condition permanently hangs the frame-grabbing thread, as it cannot be interrupted by timeouts or thread interrupts, leading to a denial of service.

Recommendations Update JavaCV to version 1.5.14. As a temporary mitigation, restrict the use of IPCameraFrameGrabber to only connect to trusted camera endpoints and avoid using plaintext HTTP streams that are susceptible to network tampering.