CVE-2026-102834

Received Received - Intake

IPCameraFrameGrabber MJPEG Content-Length Buffer Overflow

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doubles a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length. An application consumes an MJPEG response from a malicious camera endpoint or a tampered plaintext stream. The source can return an oversized Content-Length header in an MJPEG stream. Successful exploitation can trap the frame-grabbing thread in a permanent CPU-spinning loop and deny service. This issue is fixed in version 1.5.14.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-102834

EUVD

EUVD-2026-103157

Affected Vendors & Products

Vendor	Product	Version / Range
bytedeco	javacv	< 1.5.14

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

JavaCV before 1.5.14 has a vulnerability in IPCameraFrameGrabber where a 32-bit buffer capacity is doubled without checking for overflow or validating the Content-Length header in MJPEG streams. This allows a malicious source to provide an oversized header, causing the frame-grabbing thread to enter an infinite CPU loop and deny service.

Detection Guidance

Detecting this vulnerability requires monitoring for abnormal MJPEG stream responses with oversized Content-Length headers. Check network traffic for unusually large headers or malformed MJPEG streams. Use tools like Wireshark to inspect HTTP responses from cameras or multimedia endpoints for Content-Length values exceeding typical MJPEG payload sizes.

Impact Analysis

This vulnerability can cause denial of service by trapping the application's frame-grabbing thread in a CPU-spinning loop, preventing it from processing frames or performing other tasks. It may lead to system unresponsiveness or crashes if exploited.

Compliance Impact

This vulnerability causes a denial of service by trapping a thread in a CPU-spinning loop, which could disrupt system availability. For GDPR, this may impact data processing operations requiring uptime. For HIPAA, it could affect systems handling protected health information by degrading service availability.

Mitigation Strategies

Upgrade JavaCV to version 1.5.14 or later to address the buffer overflow issue. If upgrading is not immediately possible, restrict network access to vulnerable cameras or endpoints and monitor for suspicious MJPEG streams. Disable or isolate affected applications until patched.

Hi! I’m here to help you understand CVE-2026-102834. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70