JavaCV CVE-2026-102834

The affected application must use JavaCV's IPCameraFrameGrabber to consume a multipart MJPEG HTTP stream, and the Content-Length header in that stream must be attacker-influenced. This requires either (a) the application pointing at a malicious or compromised IP camera endpoint, or (b) a network attacker able to tamper with the plaintext HTTP response (these feeds are conventionally served over http://, enabling on-path injection). The trigger value is a parsed Content-Length in the range 1073741825-2147483647, which forces the signed-int buffer-doubling loop to overflow. Limiting factors: it only affects deployments that actually use IPCameraFrameGrabber (not JavaCV's other grabbers), the attacker must control or intercept the stream source, and impact is confined to availability (the frame-grabbing thread hangs) - no code execution or data exposure. Deployments using trusted cameras over authenticated/encrypted channels are not practically exposed.

This is a genuine but bounded risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) with base score 7.5 reflects a network-reachable, unauthenticated, no-interaction flaw whose sole impact is availability (C:N/I:N/A:H, CWE-190 integer overflow leading to an unbreakable CPU-spinning loop). There is no EPSS score, KEV listing, or public POC provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this is a high-CVSS issue driven entirely by the availability impact, not by observed attacker interest. A key limiting signal that the raw score hides: exploitation is not opportunistic against arbitrary internet targets. The victim application must actively consume an MJPEG stream from an endpoint the attacker controls (a malicious/compromised IP camera) or the attacker must sit on-path to tamper with the conventionally plaintext http:// stream. The AV:N/AC:L rating assumes the attacker already controls the camera source; for the pure man-in-the-middle variant, real-world complexity is higher than AC:L implies - treat the network-vector rating as a best case for an attacker who owns or has intercepted the stream source. Net: a real, worth-patching DoS for anyone running JavaCV's IPCameraFrameGrabber against untrusted or network-exposed camera endpoints, but lower urgency than the 7.5 suggests for deployments using only trusted, authenticated camera sources.

An application uses JavaCV's IPCameraFrameGrabber to pull an MJPEG feed from an IP camera. An attacker who controls that camera endpoint - or who can tamper with the plaintext HTTP stream in transit - returns a multipart response whose Content-Length header is set between 1073741825 and 2147483647. When readImage() passes this value to ensureBufferCapacity(), the repeated 32-bit buffer doubling overflows to 0 and the grow loop never exits, trapping the grab() thread at 100% CPU with no timeout or interrupt path. No public exploit code is referenced, but the mechanism is fully detailed in the GHSA advisory with source snippets.