CVE-2026-102834
7.5HighPublished 16 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-190
Impact
Remote attackers controlling a camera endpoint or stream can cause a permanent denial of service by trapping the frame-grabbing thread in a 100% CPU spinning loop. This requires the application to ingest a malicious MJPEG response or tampered stream.
Root cause
IPCameraFrameGrabber doubles a 32-bit buffer capacity without bounding the parsed Content-Length or checking for integer overflow.
Affected systems
JavaCV versions prior to 1.5.14
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade the JavaCV dependency to version 1.5.14. If upgrading immediately is not possible, stop ingesting untrusted or unencrypted MJPEG camera streams.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doubles a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length. An application consumes an MJPEG response from a malicious camera endpoint or a tampered plaintext stream. The source can return an oversized Content-Length header in an MJPEG stream. Successful exploitation can trap the frame-grabbing thread in a permanent CPU-spinning loop and deny service. This issue is fixed in version 1.5.14.