Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.bytedeco:javacv | maven | < 1.5.14 | 1.5.14 |
Miggo AIRoot Cause AnalysisThe vulnerability is an integer overflow (CWE-190) in JavaCV's IPCameraFrameGrabber. The MJPEG stream reader readImage() parses the Content-Length header from the camera's HTTP response and passes it to ensureBufferCapacity(int) without any bounds check. ensureBufferCapacity() grows the pixel buffer by repeatedly doubling a 32-bit int capacity. For a Content-Length in (2^30, Integer.MAX_VALUE], the doubling overflows: capacity becomes Integer.MIN_VALUE, then 0, and the while (capacity < desiredCapacity) condition never becomes false, so the calling thread spins at 100% CPU indefinitely. The fix (commit cd1977800b827beadf3c53c4032e57172845e0b4) adds a MAX_CONTENT_LENGTH validation in readImage() and switches ensureBufferCapacity() to long arithmetic. Both modified methods are the vulnerable functions that would appear in a Java profiler stack trace during exploitation.
org.bytedeco.javacv.IPCameraFrameGrabber.readImagesrc/main/java/org/bytedeco/javacv/IPCameraFrameGrabber.java
org.bytedeco.javacv.IPCameraFrameGrabber.ensureBufferCapacitysrc/main/java/org/bytedeco/javacv/IPCameraFrameGrabber.java