An ImageIO plugin, e.g. a png or bmp decoder, throws an IIOException when the image header is corrupted. Because this exception is not thrown within a try-finally block, the stream is never reset as it is on normal operation.

See http://mail.openjdk.java.net/pipermail/2d-dev/2015-November/005878.html for more details.