ZeroDay Findings
Sign inSign up

Findings

CVE-2026-102834

JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS

Published Oct 16, 2026 · corrected/updated Oct 16, 2026 · evidence confidence medium

### Summary parses the value from the multipart MJPEG HTTP stream returned by the configured IP camera without any bounds checking. A malicious or compromised camera endpoint - or any network attacker able to tamper with the plaintext HTTP response (these streams are conventionally accessed over , as documented in the class itself) - can supply a value in the range - . This drives the internal buffer-growth routine into 32-bit signed integer overflow, which turns the "grow the buffer" loop into a true infinite loop: the loop variable oscillates to and never again satisfies the loop's exit condition. The thread that called / spins at 100% CPU forever and never returns, permanently hanging the calling application's frame-grabbing thread with no exception, timeout, or interrupt path available to the caller. ### Details File: is taken verbatim from the HTTP response headers of the camera stream and passed directly into with no upper-bound validation (the comment "adaptive size - careful - don't want a 2G jpeg" shows the author was aware of the risk but never implemented a check). repeatedly doubles (a 32-bit , starting at ) until it is . If is greater than ( ) but ( ): 1. reaches ( ) after 20 doublings; the loop condition is still true. 2. computes , which overflows a signed 32-bit and wraps to ( ). 3. The loop condition (a negative number compared to a large positive ) is still true, so the loop continues. 4. computes , which in two's-complement 32-bit arithmetic wraps to . 5. From this point on, is permanently ( ), and remains true forever - the loop never terminates. This is a pure CPU-bound loop with no I/O, no blocking call, and no check, so it cannot be interrupted via and will not respect any / configured on the grabber (those only apply to the socket read that happens *before* this code path). The only remedy is killing the JVM/thread from outside. ### PoC A minimal malicious/MITM'd MJPEG server that reproduces the hang: Java client (representative of any applic

Grounded briefings

Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.

Executive

CVE-2026-102834 is a high public vulnerability record for this product. It is not currently listed in the CISA Known Exploited catalog. Check the linked vendor or CERT advisories for patch status. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.

System administrator

Identify whether this product is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: org.bytedeco:javacv (0 → 1.5.14); org.bytedeco:javacv (< 1.5.14). Check the linked vendor or CERT advisories for patch status. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.

Security analyst

Signals on file: CVSS 7.5. It is not currently listed in the CISA Known Exploited catalog. Weakness classes: CWE-190. Sources contributing to this record: github, osv. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.

Exploitation and remediation

  • Exploitation evidence

    Not listed as known exploited in CISA KEV. Not in CISA KEV or VulnCheck KEV.

  • Patch and remediation

    No required-action text is stored yet. Use the vendor or CERT links in Sources for patch availability.

  • Safe detection guidance

    Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 16, 2026 · GitHub Advisory Database

    Detected

    ### Summary parses the value from the multipart MJPEG HTTP stream returned by the configured IP camera without any bounds checking. A malicious or compromised camera endpoint - or any network attacker able to tamper with the plaintext HTTP response (these streams are conventionally accessed over , as documented in the class itself) - can supply a value in the range - . This drives the internal buf

  2. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    org.bytedeco:javacv fixed in 1.5.14

  3. Oct 16, 2026 · GitHub Advisory Database

    Fix available

    org.bytedeco:javacv fixed in 1.5.14

  4. Oct 16, 2026 · GitHub Advisory Database

    Updated

    ### Summary parses the value from the multipart MJPEG HTTP stream returned by the configured IP camera without any bounds checking. A malicious or compromised camera endpoint - or any network attacker able to tamper with the plaintext HTTP response (these streams are conventionally accessed over , as documented in the class itself) - can supply a value in the range - . This drives the internal buf

Affected

  • Maven org.bytedeco:javacv0 → 1.5.14
  • maven org.bytedeco:javacv< 1.5.14

Sources

References