The vulnerability is an integer overflow that occurs when IPCameraFrameGrabber doubles a 32‑bit buffer capacity in the JavaCV library without checking for overflow or bounding the parsed Content‑Length. This flaw can cause the frame‑grabbing thread to enter an infinite CPU‑spinning loop, resulting in a denial of service for applications that rely on IP camera streams. The impact is limited to the process that consumes the MJPEG stream, but it can exhaust system resources and disrupt normal service operation. The flaw is a CWE-190 integer overflow.

CVE‑2026‑102834 exposes the JavaCV library by bytedeco, affecting all versions prior to 1.5.14. Applications that import or depend on JavaCV 1.5.13 and earlier are at risk when they process MJPEG streams from untrusted or malicious camera endpoints.

The CVSS score of 7.5 indicates a high severity. Attackers can trigger the issue remotely by delivering a specially crafted MJPEG stream that contains an oversized Content‑Length header, as the flaw is activated during frame grabbing without input validation. EPSS information is not available, and the vulnerability is not listed in CISA KEV. As a result, the risk lies in the remote exploitation of the camera feed, potentially leading to a denial of service without requiring privileged access.