Read the docs
TI-2026-76000 Aliases CVE-2026-102834GHSA-rxjv-24xq-76wc

Integer overflow in JavaCV IPCameraFrameGrabber causes infinite loop

Priority HIGH 72CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-190 and the CVSS impact.

Summary

JavaCV before 1.5.14 is affected. IPCameraFrameGrabber doubles a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length, which is an integer overflow (CWE-190). An application that consumes an MJPEG response from a malicious camera endpoint or a tampered plaintext stream can receive an oversized Content-Length, which traps the frame-grabbing thread in a permanent CPU-spinning loop and denies service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doubles a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length. An application consumes an MJPEG response from a malicious camera endpoint or a tampered plaintext stream. The source can return an oversized Content-Length header in an MJPEG stream. Successful exploitation can trap the frame-grabbing thread in a permanent CPU-spinning loop and deny service. This issue is fixed in version 1.5.14.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00503 43rd percentileScored 2026-11-07
Fix Fixed javacv (bytedeco): 1.5.14org.bytedeco:javacv (Maven): 1.5.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
bytedecojavacvbefore 1.5.141.5.14Patch availableCNA
—org.bytedeco:javacv (Maven)before 1.5.141.5.14Patch availableGHSA-rxjv-24xq-76wc
  • javacv Vendorbytedeco Affected before 1.5.14 Fixed in 1.5.14 Patch available CNA
  • org.bytedeco:javacv (Maven) Vendor— Affected before 1.5.14 Fixed in 1.5.14 Patch available GHSA-rxjv-24xq-76wc

Remediation

The Maven package org.bytedeco:javacv is fixed in version 1.5.14. The sources list no fixed version for javacv.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA javacv (bytedeco) Fixed in 1.5.14
  • Fix · GHSA-rxjv-24xq-76wc org.bytedeco:javacv (Maven) Fixed in 1.5.14 Advisory →

Timeline

  1. 2026-10-18 Threatist record created from CVE-2026-102834
  2. 2026-10-18 Alias added: GHSA-rxjv-24xq-76wc
  3. 2026-10-18 Fix available: Maven/org.bytedeco:[email protected] · GHSA-rxjv-24xq-76wc
  4. 2026-10-18 CVSS score added · GHSA-rxjv-24xq-76wc
  5. 2026-10-18 Weakness changed · GHSA-rxjv-24xq-76wc
  6. 2026-10-18 4 new references · GHSA-rxjv-24xq-76wc
  7. 2026-10-18 Priority changed: MEDIUM → LOW
  8. 2026-10-28 CISA SSVC decision points changed
  9. 2026-10-28 Priority changed: LOW → HIGH

References

Other 4

  • TI-2023-16958 JavaCPP project actions vulnerable to code injection CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences