Vulnerability-Lookup

URL	Tags
https://github.com/gphoto/libgphoto2/security/adv…	x_refsource_CONFIRM
https://github.com/gphoto/libgphoto2/commit/3b9f9…	x_refsource_MISC

Vendor	Product	Version	CPE status
gphoto	libgphoto2	Affected: <= 2.5.33	guessed

FKIE_CVE-2026-40338

Vulnerability from fkie_nvd - Published: 2026-04-18 00:16 - Updated: 2026-06-17 10:45

Severity

5.2 (Medium) - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Summary

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in the PTP_DPFF_Enumeration case of `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (line 856). The function reads a 2-byte enumeration count N via `dtoh16o(data, *poffset)` without verifying that 2 bytes remain in the buffer. The standard `ptp_unpack_DPD()` at line 704 has this exact check, confirming the Sony variant omitted it by oversight. Commit 3b9f9696be76ae51dca983d9dd8ce586a2561845 fixes the issue.

References

	URL	Tags
	security-advisories@github.com	https://github.com/gphoto/libgphoto2/commit/3b9f9696be76ae51dca983d9dd8ce586a2561845
	security-advisories@github.com	https://github.com/gphoto/libgphoto2/security/advisories/GHSA-2hwp-w84q-27hf

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "libgphoto2",
          "vendor": "gphoto",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 2.5.33"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in the PTP_DPFF_Enumeration case of `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (line 856). The function reads a 2-byte enumeration count N via `dtoh16o(data, *poffset)` without verifying that 2 bytes remain in the buffer. The standard `ptp_unpack_DPD()` at line 704 has this exact check, confirming the Sony variant omitted it by oversight. Commit 3b9f9696be76ae51dca983d9dd8ce586a2561845 fixes the issue."
    }
  ],
  "id": "CVE-2026-40338",
  "lastModified": "2026-06-17T10:45:08.610",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "PHYSICAL",
          "availabilityImpact": "LOW",
          "baseScore": 5.2,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-40338",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-20T16:13:41.644804Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-18T00:16:37.810",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/gphoto/libgphoto2/commit/3b9f9696be76ae51dca983d9dd8ce586a2561845"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/gphoto/libgphoto2/security/advisories/GHSA-2hwp-w84q-27hf"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

oesa-2026-2067

Vulnerability from osv_openeuler

Published

2026-04-25 11:11

Modified

2026-08-06 11:11

Summary

libgphoto2 security update

Details

is the core of gphoto2 software. It is a portable library which gives access to literally hundreds of digital cameras.

Security Fix(es):

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in the ptp_unpack_Canon_FE() function in camlibs/ptp2/ptp-pack.c (line 1377). The function copies a filename into a 13-byte buffer using strncpy without explicitly null-terminating the result. If the source data is exactly 13 bytes with no null terminator, the buffer is left unterminated, leading to out-of-bounds reads in any subsequent string operation.(CVE-2026-40334)

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the ptp_unpack_DPV() function within camlibs/ptp2/ptp-pack.c (lines 622–629). When handling UINT128 and INT128 data types, the code advances the buffer offset by *offset += 16 without verifying that 16 bytes remain in the buffer. The entry check at line 609 only ensures *offset < total (at least 1 byte available), leaving up to 15 bytes unvalidated. This could lead to reading beyond the buffer boundary, resulting in a crash or information disclosure. The issue has been patched in commit 433bde9888d70aa726e32744cd751d7dbe94379a.(CVE-2026-40335)

libgphoto2 is an open-source library for accessing and controlling cameras. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the ptp_unpack_Sony_DPD() function (line 856) within the file camlibs/ptp2/ptp-pack.c, specifically in the PTP_DPFF_Enumeration case. The function reads a 2-byte enumeration count N via dtoh16o(data, *poffset) without verifying that at least 2 bytes remain in the buffer. The standard ptp_unpack_DPD() function (line 704) includes this exact check, indicating the omission in the Sony variant was an oversight. An attacker could exploit this vulnerability to read data beyond the bounds of the process memory, potentially leading to information disclosure or application crash.(CVE-2026-40338)

libgphoto2 is an open-source library for accessing and controlling cameras. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the ptp_unpack_Sony_DPD() function (line 842) within the file camlibs/ptp2/ptp-pack.c. The function reads the FormFlag byte via dtoh8o(data, *poffset) without performing a prior bounds check. The standard ptp_unpack_DPD() function (lines 686–687) correctly validates *offset + sizeof(uint8_t) > dpdlen before this same read, but the Sony-specific variant omits this check entirely, potentially allowing read access beyond the allocated buffer.(CVE-2026-40339)

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the ptp_unpack_OI() function within camlibs/ptp2/ptp-pack.c (lines 530–563). The function validates len < PTP_oi_SequenceNumber (i.e., len < 48) but subsequently accesses offsets 48–56, up to 9 bytes beyond the validated boundary, via the Samsung Galaxy 64-bit objectsize detection heuristic. An attacker can exploit this vulnerability by sending a malicious PTP ObjectInfo response, potentially leading to sensitive information disclosure or application crash.(CVE-2026-40340)

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, an out-of-bounds read vulnerability exists in the ptp_unpack_EOS_FocusInfoEx function. This vulnerability could be exploited by an attacker to crash libgphoto2 (Denial of Service) when processing input from untrusted USB devices.(CVE-2026-40341)

Severity

6.1 (Medium)


                    
                      CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40334	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40335	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40338	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40339	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40340	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40341	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "libgphoto2-2.5.31-3.oe2403.aarch64.rpm",
          "libgphoto2-debuginfo-2.5.31-3.oe2403.aarch64.rpm",
          "libgphoto2-debugsource-2.5.31-3.oe2403.aarch64.rpm",
          "libgphoto2-devel-2.5.31-3.oe2403.aarch64.rpm"
        ],
        "noarch": [
          "libgphoto2-help-2.5.31-3.oe2403.noarch.rpm"
        ],
        "src": [
          "libgphoto2-2.5.31-3.oe2403.src.rpm"
        ],
        "x86_64": [
          "libgphoto2-2.5.31-3.oe2403.x86_64.rpm",
          "libgphoto2-debuginfo-2.5.31-3.oe2403.x86_64.rpm",
          "libgphoto2-debugsource-2.5.31-3.oe2403.x86_64.rpm",
          "libgphoto2-devel-2.5.31-3.oe2403.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS",
        "name": "libgphoto2",
        "purl": "pkg:rpm/openEuler/libgphoto2\u0026distro=openEuler-24.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.31-3.oe2403"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Medium"
  },
  "details": "is the core of gphoto2 software. It is a portable library which gives access to literally hundreds of digital cameras.\r\n\r\nSecurity Fix(es):\n\nlibgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in the ptp_unpack_Canon_FE() function in camlibs/ptp2/ptp-pack.c (line 1377). The function copies a filename into a 13-byte buffer using strncpy without explicitly null-terminating the result. If the source data is exactly 13 bytes with no null terminator, the buffer is left unterminated, leading to out-of-bounds reads in any subsequent string operation.(CVE-2026-40334)\n\nlibgphoto2 is a camera access and control library. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the `ptp_unpack_DPV()` function within `camlibs/ptp2/ptp-pack.c` (lines 622\u2013629). When handling UINT128 and INT128 data types, the code advances the buffer offset by `*offset += 16` without verifying that 16 bytes remain in the buffer. The entry check at line 609 only ensures `*offset \u0026lt; total` (at least 1 byte available), leaving up to 15 bytes unvalidated. This could lead to reading beyond the buffer boundary, resulting in a crash or information disclosure. The issue has been patched in commit 433bde9888d70aa726e32744cd751d7dbe94379a.(CVE-2026-40335)\n\nlibgphoto2 is an open-source library for accessing and controlling cameras. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the `ptp_unpack_Sony_DPD()` function (line 856) within the file `camlibs/ptp2/ptp-pack.c`, specifically in the `PTP_DPFF_Enumeration` case. The function reads a 2-byte enumeration count N via `dtoh16o(data, *poffset)` without verifying that at least 2 bytes remain in the buffer. The standard `ptp_unpack_DPD()` function (line 704) includes this exact check, indicating the omission in the Sony variant was an oversight. An attacker could exploit this vulnerability to read data beyond the bounds of the process memory, potentially leading to information disclosure or application crash.(CVE-2026-40338)\n\nlibgphoto2 is an open-source library for accessing and controlling cameras. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the `ptp_unpack_Sony_DPD()` function (line 842) within the file `camlibs/ptp2/ptp-pack.c`. The function reads the FormFlag byte via `dtoh8o(data, *poffset)` without performing a prior bounds check. The standard `ptp_unpack_DPD()` function (lines 686\u2013687) correctly validates `*offset + sizeof(uint8_t) \u0026gt; dpdlen` before this same read, but the Sony-specific variant omits this check entirely, potentially allowing read access beyond the allocated buffer.(CVE-2026-40339)\n\nlibgphoto2 is a camera access and control library. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the `ptp_unpack_OI()` function within `camlibs/ptp2/ptp-pack.c` (lines 530\u2013563). The function validates `len \u0026lt; PTP_oi_SequenceNumber` (i.e., len \u0026lt; 48) but subsequently accesses offsets 48\u201356, up to 9 bytes beyond the validated boundary, via the Samsung Galaxy 64-bit objectsize detection heuristic. An attacker can exploit this vulnerability by sending a malicious PTP ObjectInfo response, potentially leading to sensitive information disclosure or application crash.(CVE-2026-40340)\n\nlibgphoto2 is a camera access and control library. In versions up to and including 2.5.33, an out-of-bounds read vulnerability exists in the `ptp_unpack_EOS_FocusInfoEx` function. This vulnerability could be exploited by an attacker to crash libgphoto2 (Denial of Service) when processing input from untrusted USB devices.(CVE-2026-40341)",
  "id": "OESA-2026-2067",
  "modified": "2026-08-06T11:11:04Z",
  "published": "2026-04-25T11:11:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2067"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40334"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40335"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40338"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40339"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40340"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40341"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "libgphoto2 security update",
  "upstream": [
    "CVE-2026-40334",
    "CVE-2026-40335",
    "CVE-2026-40338",
    "CVE-2026-40339",
    "CVE-2026-40340",
    "CVE-2026-40341"
  ]
}

oesa-2026-2068

Vulnerability from osv_openeuler

Published

2026-04-25 11:11

Modified

2026-08-06 11:11

Summary

libgphoto2 security update

Details

is the core of gphoto2 software. It is a portable library which gives access to literally hundreds of digital cameras.

Security Fix(es):

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in the ptp_unpack_Canon_FE() function in camlibs/ptp2/ptp-pack.c (line 1377). The function copies a filename into a 13-byte buffer using strncpy without explicitly null-terminating the result. If the source data is exactly 13 bytes with no null terminator, the buffer is left unterminated, leading to out-of-bounds reads in any subsequent string operation.(CVE-2026-40334)

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the ptp_unpack_DPV() function within camlibs/ptp2/ptp-pack.c (lines 622–629). When handling UINT128 and INT128 data types, the code advances the buffer offset by *offset += 16 without verifying that 16 bytes remain in the buffer. The entry check at line 609 only ensures *offset < total (at least 1 byte available), leaving up to 15 bytes unvalidated. This could lead to reading beyond the buffer boundary, resulting in a crash or information disclosure. The issue has been patched in commit 433bde9888d70aa726e32744cd751d7dbe94379a.(CVE-2026-40335)

libgphoto2 is an open-source library for accessing and controlling cameras. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the ptp_unpack_Sony_DPD() function (line 856) within the file camlibs/ptp2/ptp-pack.c, specifically in the PTP_DPFF_Enumeration case. The function reads a 2-byte enumeration count N via dtoh16o(data, *poffset) without verifying that at least 2 bytes remain in the buffer. The standard ptp_unpack_DPD() function (line 704) includes this exact check, indicating the omission in the Sony variant was an oversight. An attacker could exploit this vulnerability to read data beyond the bounds of the process memory, potentially leading to information disclosure or application crash.(CVE-2026-40338)

libgphoto2 is an open-source library for accessing and controlling cameras. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the ptp_unpack_Sony_DPD() function (line 842) within the file camlibs/ptp2/ptp-pack.c. The function reads the FormFlag byte via dtoh8o(data, *poffset) without performing a prior bounds check. The standard ptp_unpack_DPD() function (lines 686–687) correctly validates *offset + sizeof(uint8_t) > dpdlen before this same read, but the Sony-specific variant omits this check entirely, potentially allowing read access beyond the allocated buffer.(CVE-2026-40339)

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the ptp_unpack_OI() function within camlibs/ptp2/ptp-pack.c (lines 530–563). The function validates len < PTP_oi_SequenceNumber (i.e., len < 48) but subsequently accesses offsets 48–56, up to 9 bytes beyond the validated boundary, via the Samsung Galaxy 64-bit objectsize detection heuristic. An attacker can exploit this vulnerability by sending a malicious PTP ObjectInfo response, potentially leading to sensitive information disclosure or application crash.(CVE-2026-40340)

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, an out-of-bounds read vulnerability exists in the ptp_unpack_EOS_FocusInfoEx function. This vulnerability could be exploited by an attacker to crash libgphoto2 (Denial of Service) when processing input from untrusted USB devices.(CVE-2026-40341)

Severity

6.1 (Medium)


                    
                      CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40334	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40335	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40338	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40339	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40340	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40341	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "libgphoto2-2.5.31-3.oe2403sp1.aarch64.rpm",
          "libgphoto2-debuginfo-2.5.31-3.oe2403sp1.aarch64.rpm",
          "libgphoto2-debugsource-2.5.31-3.oe2403sp1.aarch64.rpm",
          "libgphoto2-devel-2.5.31-3.oe2403sp1.aarch64.rpm"
        ],
        "noarch": [
          "libgphoto2-help-2.5.31-3.oe2403sp1.noarch.rpm"
        ],
        "src": [
          "libgphoto2-2.5.31-3.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "libgphoto2-2.5.31-3.oe2403sp1.x86_64.rpm",
          "libgphoto2-debuginfo-2.5.31-3.oe2403sp1.x86_64.rpm",
          "libgphoto2-debugsource-2.5.31-3.oe2403sp1.x86_64.rpm",
          "libgphoto2-devel-2.5.31-3.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "libgphoto2",
        "purl": "pkg:rpm/openEuler/libgphoto2\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.31-3.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Medium"
  },
  "details": "is the core of gphoto2 software. It is a portable library which gives access to literally hundreds of digital cameras.\r\n\r\nSecurity Fix(es):\n\nlibgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in the ptp_unpack_Canon_FE() function in camlibs/ptp2/ptp-pack.c (line 1377). The function copies a filename into a 13-byte buffer using strncpy without explicitly null-terminating the result. If the source data is exactly 13 bytes with no null terminator, the buffer is left unterminated, leading to out-of-bounds reads in any subsequent string operation.(CVE-2026-40334)\n\nlibgphoto2 is a camera access and control library. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the `ptp_unpack_DPV()` function within `camlibs/ptp2/ptp-pack.c` (lines 622\u2013629). When handling UINT128 and INT128 data types, the code advances the buffer offset by `*offset += 16` without verifying that 16 bytes remain in the buffer. The entry check at line 609 only ensures `*offset \u0026lt; total` (at least 1 byte available), leaving up to 15 bytes unvalidated. This could lead to reading beyond the buffer boundary, resulting in a crash or information disclosure. The issue has been patched in commit 433bde9888d70aa726e32744cd751d7dbe94379a.(CVE-2026-40335)\n\nlibgphoto2 is an open-source library for accessing and controlling cameras. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the `ptp_unpack_Sony_DPD()` function (line 856) within the file `camlibs/ptp2/ptp-pack.c`, specifically in the `PTP_DPFF_Enumeration` case. The function reads a 2-byte enumeration count N via `dtoh16o(data, *poffset)` without verifying that at least 2 bytes remain in the buffer. The standard `ptp_unpack_DPD()` function (line 704) includes this exact check, indicating the omission in the Sony variant was an oversight. An attacker could exploit this vulnerability to read data beyond the bounds of the process memory, potentially leading to information disclosure or application crash.(CVE-2026-40338)\n\nlibgphoto2 is an open-source library for accessing and controlling cameras. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the `ptp_unpack_Sony_DPD()` function (line 842) within the file `camlibs/ptp2/ptp-pack.c`. The function reads the FormFlag byte via `dtoh8o(data, *poffset)` without performing a prior bounds check. The standard `ptp_unpack_DPD()` function (lines 686\u2013687) correctly validates `*offset + sizeof(uint8_t) \u0026gt; dpdlen` before this same read, but the Sony-specific variant omits this check entirely, potentially allowing read access beyond the allocated buffer.(CVE-2026-40339)\n\nlibgphoto2 is a camera access and control library. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the `ptp_unpack_OI()` function within `camlibs/ptp2/ptp-pack.c` (lines 530\u2013563). The function validates `len \u0026lt; PTP_oi_SequenceNumber` (i.e., len \u0026lt; 48) but subsequently accesses offsets 48\u201356, up to 9 bytes beyond the validated boundary, via the Samsung Galaxy 64-bit objectsize detection heuristic. An attacker can exploit this vulnerability by sending a malicious PTP ObjectInfo response, potentially leading to sensitive information disclosure or application crash.(CVE-2026-40340)\n\nlibgphoto2 is a camera access and control library. In versions up to and including 2.5.33, an out-of-bounds read vulnerability exists in the `ptp_unpack_EOS_FocusInfoEx` function. This vulnerability could be exploited by an attacker to crash libgphoto2 (Denial of Service) when processing input from untrusted USB devices.(CVE-2026-40341)",
  "id": "OESA-2026-2068",
  "modified": "2026-08-06T11:11:04Z",
  "published": "2026-04-25T11:11:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2068"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40334"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40335"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40338"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40339"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40340"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40341"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "libgphoto2 security update",
  "upstream": [
    "CVE-2026-40334",
    "CVE-2026-40335",
    "CVE-2026-40338",
    "CVE-2026-40339",
    "CVE-2026-40340",
    "CVE-2026-40341"
  ]
}

oesa-2026-2069

Vulnerability from osv_openeuler

Published

2026-04-25 11:11

Modified

2026-08-06 11:11

Summary

libgphoto2 security update

Details

is the core of gphoto2 software. It is a portable library which gives access to literally hundreds of digital cameras.

Security Fix(es):

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in the ptp_unpack_Canon_FE() function in camlibs/ptp2/ptp-pack.c (line 1377). The function copies a filename into a 13-byte buffer using strncpy without explicitly null-terminating the result. If the source data is exactly 13 bytes with no null terminator, the buffer is left unterminated, leading to out-of-bounds reads in any subsequent string operation.(CVE-2026-40334)

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the ptp_unpack_DPV() function within camlibs/ptp2/ptp-pack.c (lines 622–629). When handling UINT128 and INT128 data types, the code advances the buffer offset by *offset += 16 without verifying that 16 bytes remain in the buffer. The entry check at line 609 only ensures *offset < total (at least 1 byte available), leaving up to 15 bytes unvalidated. This could lead to reading beyond the buffer boundary, resulting in a crash or information disclosure. The issue has been patched in commit 433bde9888d70aa726e32744cd751d7dbe94379a.(CVE-2026-40335)

libgphoto2 is an open-source library for accessing and controlling cameras. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the ptp_unpack_Sony_DPD() function (line 856) within the file camlibs/ptp2/ptp-pack.c, specifically in the PTP_DPFF_Enumeration case. The function reads a 2-byte enumeration count N via dtoh16o(data, *poffset) without verifying that at least 2 bytes remain in the buffer. The standard ptp_unpack_DPD() function (line 704) includes this exact check, indicating the omission in the Sony variant was an oversight. An attacker could exploit this vulnerability to read data beyond the bounds of the process memory, potentially leading to information disclosure or application crash.(CVE-2026-40338)

libgphoto2 is an open-source library for accessing and controlling cameras. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the ptp_unpack_Sony_DPD() function (line 842) within the file camlibs/ptp2/ptp-pack.c. The function reads the FormFlag byte via dtoh8o(data, *poffset) without performing a prior bounds check. The standard ptp_unpack_DPD() function (lines 686–687) correctly validates *offset + sizeof(uint8_t) > dpdlen before this same read, but the Sony-specific variant omits this check entirely, potentially allowing read access beyond the allocated buffer.(CVE-2026-40339)

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the ptp_unpack_OI() function within camlibs/ptp2/ptp-pack.c (lines 530–563). The function validates len < PTP_oi_SequenceNumber (i.e., len < 48) but subsequently accesses offsets 48–56, up to 9 bytes beyond the validated boundary, via the Samsung Galaxy 64-bit objectsize detection heuristic. An attacker can exploit this vulnerability by sending a malicious PTP ObjectInfo response, potentially leading to sensitive information disclosure or application crash.(CVE-2026-40340)

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, an out-of-bounds read vulnerability exists in the ptp_unpack_EOS_FocusInfoEx function. This vulnerability could be exploited by an attacker to crash libgphoto2 (Denial of Service) when processing input from untrusted USB devices.(CVE-2026-40341)

Severity

6.1 (Medium)


                    
                      CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40334	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40335	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40338	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40339	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40340	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40341	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "libgphoto2-2.5.31-3.oe2403sp3.aarch64.rpm",
          "libgphoto2-debuginfo-2.5.31-3.oe2403sp3.aarch64.rpm",
          "libgphoto2-debugsource-2.5.31-3.oe2403sp3.aarch64.rpm",
          "libgphoto2-devel-2.5.31-3.oe2403sp3.aarch64.rpm"
        ],
        "noarch": [
          "libgphoto2-help-2.5.31-3.oe2403sp3.noarch.rpm"
        ],
        "src": [
          "libgphoto2-2.5.31-3.oe2403sp3.src.rpm"
        ],
        "x86_64": [
          "libgphoto2-2.5.31-3.oe2403sp3.x86_64.rpm",
          "libgphoto2-debuginfo-2.5.31-3.oe2403sp3.x86_64.rpm",
          "libgphoto2-debugsource-2.5.31-3.oe2403sp3.x86_64.rpm",
          "libgphoto2-devel-2.5.31-3.oe2403sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP3",
        "name": "libgphoto2",
        "purl": "pkg:rpm/openEuler/libgphoto2\u0026distro=openEuler-24.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.31-3.oe2403sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Medium"
  },
  "details": "is the core of gphoto2 software. It is a portable library which gives access to literally hundreds of digital cameras.\r\n\r\nSecurity Fix(es):\n\nlibgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in the ptp_unpack_Canon_FE() function in camlibs/ptp2/ptp-pack.c (line 1377). The function copies a filename into a 13-byte buffer using strncpy without explicitly null-terminating the result. If the source data is exactly 13 bytes with no null terminator, the buffer is left unterminated, leading to out-of-bounds reads in any subsequent string operation.(CVE-2026-40334)\n\nlibgphoto2 is a camera access and control library. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the `ptp_unpack_DPV()` function within `camlibs/ptp2/ptp-pack.c` (lines 622\u2013629). When handling UINT128 and INT128 data types, the code advances the buffer offset by `*offset += 16` without verifying that 16 bytes remain in the buffer. The entry check at line 609 only ensures `*offset \u0026lt; total` (at least 1 byte available), leaving up to 15 bytes unvalidated. This could lead to reading beyond the buffer boundary, resulting in a crash or information disclosure. The issue has been patched in commit 433bde9888d70aa726e32744cd751d7dbe94379a.(CVE-2026-40335)\n\nlibgphoto2 is an open-source library for accessing and controlling cameras. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the `ptp_unpack_Sony_DPD()` function (line 856) within the file `camlibs/ptp2/ptp-pack.c`, specifically in the `PTP_DPFF_Enumeration` case. The function reads a 2-byte enumeration count N via `dtoh16o(data, *poffset)` without verifying that at least 2 bytes remain in the buffer. The standard `ptp_unpack_DPD()` function (line 704) includes this exact check, indicating the omission in the Sony variant was an oversight. An attacker could exploit this vulnerability to read data beyond the bounds of the process memory, potentially leading to information disclosure or application crash.(CVE-2026-40338)\n\nlibgphoto2 is an open-source library for accessing and controlling cameras. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the `ptp_unpack_Sony_DPD()` function (line 842) within the file `camlibs/ptp2/ptp-pack.c`. The function reads the FormFlag byte via `dtoh8o(data, *poffset)` without performing a prior bounds check. The standard `ptp_unpack_DPD()` function (lines 686\u2013687) correctly validates `*offset + sizeof(uint8_t) \u0026gt; dpdlen` before this same read, but the Sony-specific variant omits this check entirely, potentially allowing read access beyond the allocated buffer.(CVE-2026-40339)\n\nlibgphoto2 is a camera access and control library. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the `ptp_unpack_OI()` function within `camlibs/ptp2/ptp-pack.c` (lines 530\u2013563). The function validates `len \u0026lt; PTP_oi_SequenceNumber` (i.e., len \u0026lt; 48) but subsequently accesses offsets 48\u201356, up to 9 bytes beyond the validated boundary, via the Samsung Galaxy 64-bit objectsize detection heuristic. An attacker can exploit this vulnerability by sending a malicious PTP ObjectInfo response, potentially leading to sensitive information disclosure or application crash.(CVE-2026-40340)\n\nlibgphoto2 is a camera access and control library. In versions up to and including 2.5.33, an out-of-bounds read vulnerability exists in the `ptp_unpack_EOS_FocusInfoEx` function. This vulnerability could be exploited by an attacker to crash libgphoto2 (Denial of Service) when processing input from untrusted USB devices.(CVE-2026-40341)",
  "id": "OESA-2026-2069",
  "modified": "2026-08-06T11:11:04Z",
  "published": "2026-04-25T11:11:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2069"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40334"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40335"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40338"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40339"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40340"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40341"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "libgphoto2 security update",
  "upstream": [
    "CVE-2026-40334",
    "CVE-2026-40335",
    "CVE-2026-40338",
    "CVE-2026-40339",
    "CVE-2026-40340",
    "CVE-2026-40341"
  ]
}

oesa-2026-2070

Vulnerability from osv_openeuler

Published

2026-04-25 11:11

Modified

2026-08-06 11:11

Summary

libgphoto2 security update

Details

is the core of gphoto2 software. It is a portable library which gives access to literally hundreds of digital cameras.

Security Fix(es):

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in the ptp_unpack_Canon_FE() function in camlibs/ptp2/ptp-pack.c (line 1377). The function copies a filename into a 13-byte buffer using strncpy without explicitly null-terminating the result. If the source data is exactly 13 bytes with no null terminator, the buffer is left unterminated, leading to out-of-bounds reads in any subsequent string operation.(CVE-2026-40334)

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the ptp_unpack_DPV() function within camlibs/ptp2/ptp-pack.c (lines 622–629). When handling UINT128 and INT128 data types, the code advances the buffer offset by *offset += 16 without verifying that 16 bytes remain in the buffer. The entry check at line 609 only ensures *offset < total (at least 1 byte available), leaving up to 15 bytes unvalidated. This could lead to reading beyond the buffer boundary, resulting in a crash or information disclosure. The issue has been patched in commit 433bde9888d70aa726e32744cd751d7dbe94379a.(CVE-2026-40335)

libgphoto2 is an open-source library for accessing and controlling cameras. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the ptp_unpack_Sony_DPD() function (line 856) within the file camlibs/ptp2/ptp-pack.c, specifically in the PTP_DPFF_Enumeration case. The function reads a 2-byte enumeration count N via dtoh16o(data, *poffset) without verifying that at least 2 bytes remain in the buffer. The standard ptp_unpack_DPD() function (line 704) includes this exact check, indicating the omission in the Sony variant was an oversight. An attacker could exploit this vulnerability to read data beyond the bounds of the process memory, potentially leading to information disclosure or application crash.(CVE-2026-40338)

libgphoto2 is an open-source library for accessing and controlling cameras. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the ptp_unpack_Sony_DPD() function (line 842) within the file camlibs/ptp2/ptp-pack.c. The function reads the FormFlag byte via dtoh8o(data, *poffset) without performing a prior bounds check. The standard ptp_unpack_DPD() function (lines 686–687) correctly validates *offset + sizeof(uint8_t) > dpdlen before this same read, but the Sony-specific variant omits this check entirely, potentially allowing read access beyond the allocated buffer.(CVE-2026-40339)

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the ptp_unpack_OI() function within camlibs/ptp2/ptp-pack.c (lines 530–563). The function validates len < PTP_oi_SequenceNumber (i.e., len < 48) but subsequently accesses offsets 48–56, up to 9 bytes beyond the validated boundary, via the Samsung Galaxy 64-bit objectsize detection heuristic. An attacker can exploit this vulnerability by sending a malicious PTP ObjectInfo response, potentially leading to sensitive information disclosure or application crash.(CVE-2026-40340)

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, an out-of-bounds read vulnerability exists in the ptp_unpack_EOS_FocusInfoEx function. This vulnerability could be exploited by an attacker to crash libgphoto2 (Denial of Service) when processing input from untrusted USB devices.(CVE-2026-40341)

Severity

6.1 (Medium)


                    
                      CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40334	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40335	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40338	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40339	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40340	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40341	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "libgphoto2-2.5.18-5.oe2003sp4.aarch64.rpm",
          "libgphoto2-debuginfo-2.5.18-5.oe2003sp4.aarch64.rpm",
          "libgphoto2-debugsource-2.5.18-5.oe2003sp4.aarch64.rpm",
          "libgphoto2-devel-2.5.18-5.oe2003sp4.aarch64.rpm"
        ],
        "noarch": [
          "libgphoto2-help-2.5.18-5.oe2003sp4.noarch.rpm"
        ],
        "src": [
          "libgphoto2-2.5.18-5.oe2003sp4.src.rpm"
        ],
        "x86_64": [
          "libgphoto2-2.5.18-5.oe2003sp4.x86_64.rpm",
          "libgphoto2-debuginfo-2.5.18-5.oe2003sp4.x86_64.rpm",
          "libgphoto2-debugsource-2.5.18-5.oe2003sp4.x86_64.rpm",
          "libgphoto2-devel-2.5.18-5.oe2003sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP4",
        "name": "libgphoto2",
        "purl": "pkg:rpm/openEuler/libgphoto2\u0026distro=openEuler-20.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.18-5.oe2003sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Medium"
  },
  "details": "is the core of gphoto2 software. It is a portable library which gives access to literally hundreds of digital cameras.\r\n\r\nSecurity Fix(es):\n\nlibgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in the ptp_unpack_Canon_FE() function in camlibs/ptp2/ptp-pack.c (line 1377). The function copies a filename into a 13-byte buffer using strncpy without explicitly null-terminating the result. If the source data is exactly 13 bytes with no null terminator, the buffer is left unterminated, leading to out-of-bounds reads in any subsequent string operation.(CVE-2026-40334)\n\nlibgphoto2 is a camera access and control library. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the `ptp_unpack_DPV()` function within `camlibs/ptp2/ptp-pack.c` (lines 622\u2013629). When handling UINT128 and INT128 data types, the code advances the buffer offset by `*offset += 16` without verifying that 16 bytes remain in the buffer. The entry check at line 609 only ensures `*offset \u0026lt; total` (at least 1 byte available), leaving up to 15 bytes unvalidated. This could lead to reading beyond the buffer boundary, resulting in a crash or information disclosure. The issue has been patched in commit 433bde9888d70aa726e32744cd751d7dbe94379a.(CVE-2026-40335)\n\nlibgphoto2 is an open-source library for accessing and controlling cameras. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the `ptp_unpack_Sony_DPD()` function (line 856) within the file `camlibs/ptp2/ptp-pack.c`, specifically in the `PTP_DPFF_Enumeration` case. The function reads a 2-byte enumeration count N via `dtoh16o(data, *poffset)` without verifying that at least 2 bytes remain in the buffer. The standard `ptp_unpack_DPD()` function (line 704) includes this exact check, indicating the omission in the Sony variant was an oversight. An attacker could exploit this vulnerability to read data beyond the bounds of the process memory, potentially leading to information disclosure or application crash.(CVE-2026-40338)\n\nlibgphoto2 is an open-source library for accessing and controlling cameras. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the `ptp_unpack_Sony_DPD()` function (line 842) within the file `camlibs/ptp2/ptp-pack.c`. The function reads the FormFlag byte via `dtoh8o(data, *poffset)` without performing a prior bounds check. The standard `ptp_unpack_DPD()` function (lines 686\u2013687) correctly validates `*offset + sizeof(uint8_t) \u0026gt; dpdlen` before this same read, but the Sony-specific variant omits this check entirely, potentially allowing read access beyond the allocated buffer.(CVE-2026-40339)\n\nlibgphoto2 is a camera access and control library. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the `ptp_unpack_OI()` function within `camlibs/ptp2/ptp-pack.c` (lines 530\u2013563). The function validates `len \u0026lt; PTP_oi_SequenceNumber` (i.e., len \u0026lt; 48) but subsequently accesses offsets 48\u201356, up to 9 bytes beyond the validated boundary, via the Samsung Galaxy 64-bit objectsize detection heuristic. An attacker can exploit this vulnerability by sending a malicious PTP ObjectInfo response, potentially leading to sensitive information disclosure or application crash.(CVE-2026-40340)\n\nlibgphoto2 is a camera access and control library. In versions up to and including 2.5.33, an out-of-bounds read vulnerability exists in the `ptp_unpack_EOS_FocusInfoEx` function. This vulnerability could be exploited by an attacker to crash libgphoto2 (Denial of Service) when processing input from untrusted USB devices.(CVE-2026-40341)",
  "id": "OESA-2026-2070",
  "modified": "2026-08-06T11:11:04Z",
  "published": "2026-04-25T11:11:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2070"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40334"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40335"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40338"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40339"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40340"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40341"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "libgphoto2 security update",
  "upstream": [
    "CVE-2026-40334",
    "CVE-2026-40335",
    "CVE-2026-40338",
    "CVE-2026-40339",
    "CVE-2026-40340",
    "CVE-2026-40341"
  ]
}

oesa-2026-2071

Vulnerability from osv_openeuler

Published

2026-04-25 11:11

Modified

2026-08-06 11:11

Summary

libgphoto2 security update

Details

is the core of gphoto2 software. It is a portable library which gives access to literally hundreds of digital cameras.

Security Fix(es):

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in the ptp_unpack_Canon_FE() function in camlibs/ptp2/ptp-pack.c (line 1377). The function copies a filename into a 13-byte buffer using strncpy without explicitly null-terminating the result. If the source data is exactly 13 bytes with no null terminator, the buffer is left unterminated, leading to out-of-bounds reads in any subsequent string operation.(CVE-2026-40334)

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the ptp_unpack_DPV() function within camlibs/ptp2/ptp-pack.c (lines 622–629). When handling UINT128 and INT128 data types, the code advances the buffer offset by *offset += 16 without verifying that 16 bytes remain in the buffer. The entry check at line 609 only ensures *offset < total (at least 1 byte available), leaving up to 15 bytes unvalidated. This could lead to reading beyond the buffer boundary, resulting in a crash or information disclosure. The issue has been patched in commit 433bde9888d70aa726e32744cd751d7dbe94379a.(CVE-2026-40335)

libgphoto2 is an open-source library for accessing and controlling cameras. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the ptp_unpack_Sony_DPD() function (line 856) within the file camlibs/ptp2/ptp-pack.c, specifically in the PTP_DPFF_Enumeration case. The function reads a 2-byte enumeration count N via dtoh16o(data, *poffset) without verifying that at least 2 bytes remain in the buffer. The standard ptp_unpack_DPD() function (line 704) includes this exact check, indicating the omission in the Sony variant was an oversight. An attacker could exploit this vulnerability to read data beyond the bounds of the process memory, potentially leading to information disclosure or application crash.(CVE-2026-40338)

libgphoto2 is an open-source library for accessing and controlling cameras. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the ptp_unpack_Sony_DPD() function (line 842) within the file camlibs/ptp2/ptp-pack.c. The function reads the FormFlag byte via dtoh8o(data, *poffset) without performing a prior bounds check. The standard ptp_unpack_DPD() function (lines 686–687) correctly validates *offset + sizeof(uint8_t) > dpdlen before this same read, but the Sony-specific variant omits this check entirely, potentially allowing read access beyond the allocated buffer.(CVE-2026-40339)

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the ptp_unpack_OI() function within camlibs/ptp2/ptp-pack.c (lines 530–563). The function validates len < PTP_oi_SequenceNumber (i.e., len < 48) but subsequently accesses offsets 48–56, up to 9 bytes beyond the validated boundary, via the Samsung Galaxy 64-bit objectsize detection heuristic. An attacker can exploit this vulnerability by sending a malicious PTP ObjectInfo response, potentially leading to sensitive information disclosure or application crash.(CVE-2026-40340)

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, an out-of-bounds read vulnerability exists in the ptp_unpack_EOS_FocusInfoEx function. This vulnerability could be exploited by an attacker to crash libgphoto2 (Denial of Service) when processing input from untrusted USB devices.(CVE-2026-40341)

Severity

6.1 (Medium)


                    
                      CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40334	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40335	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40338	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40339	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40340	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-40341	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "libgphoto2-2.5.18-5.oe2203sp4.aarch64.rpm",
          "libgphoto2-debuginfo-2.5.18-5.oe2203sp4.aarch64.rpm",
          "libgphoto2-debugsource-2.5.18-5.oe2203sp4.aarch64.rpm",
          "libgphoto2-devel-2.5.18-5.oe2203sp4.aarch64.rpm"
        ],
        "noarch": [
          "libgphoto2-help-2.5.18-5.oe2203sp4.noarch.rpm"
        ],
        "src": [
          "libgphoto2-2.5.18-5.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "libgphoto2-2.5.18-5.oe2203sp4.x86_64.rpm",
          "libgphoto2-debuginfo-2.5.18-5.oe2203sp4.x86_64.rpm",
          "libgphoto2-debugsource-2.5.18-5.oe2203sp4.x86_64.rpm",
          "libgphoto2-devel-2.5.18-5.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "libgphoto2",
        "purl": "pkg:rpm/openEuler/libgphoto2\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.18-5.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Medium"
  },
  "details": "is the core of gphoto2 software. It is a portable library which gives access to literally hundreds of digital cameras.\r\n\r\nSecurity Fix(es):\n\nlibgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in the ptp_unpack_Canon_FE() function in camlibs/ptp2/ptp-pack.c (line 1377). The function copies a filename into a 13-byte buffer using strncpy without explicitly null-terminating the result. If the source data is exactly 13 bytes with no null terminator, the buffer is left unterminated, leading to out-of-bounds reads in any subsequent string operation.(CVE-2026-40334)\n\nlibgphoto2 is a camera access and control library. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the `ptp_unpack_DPV()` function within `camlibs/ptp2/ptp-pack.c` (lines 622\u2013629). When handling UINT128 and INT128 data types, the code advances the buffer offset by `*offset += 16` without verifying that 16 bytes remain in the buffer. The entry check at line 609 only ensures `*offset \u0026lt; total` (at least 1 byte available), leaving up to 15 bytes unvalidated. This could lead to reading beyond the buffer boundary, resulting in a crash or information disclosure. The issue has been patched in commit 433bde9888d70aa726e32744cd751d7dbe94379a.(CVE-2026-40335)\n\nlibgphoto2 is an open-source library for accessing and controlling cameras. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the `ptp_unpack_Sony_DPD()` function (line 856) within the file `camlibs/ptp2/ptp-pack.c`, specifically in the `PTP_DPFF_Enumeration` case. The function reads a 2-byte enumeration count N via `dtoh16o(data, *poffset)` without verifying that at least 2 bytes remain in the buffer. The standard `ptp_unpack_DPD()` function (line 704) includes this exact check, indicating the omission in the Sony variant was an oversight. An attacker could exploit this vulnerability to read data beyond the bounds of the process memory, potentially leading to information disclosure or application crash.(CVE-2026-40338)\n\nlibgphoto2 is an open-source library for accessing and controlling cameras. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the `ptp_unpack_Sony_DPD()` function (line 842) within the file `camlibs/ptp2/ptp-pack.c`. The function reads the FormFlag byte via `dtoh8o(data, *poffset)` without performing a prior bounds check. The standard `ptp_unpack_DPD()` function (lines 686\u2013687) correctly validates `*offset + sizeof(uint8_t) \u0026gt; dpdlen` before this same read, but the Sony-specific variant omits this check entirely, potentially allowing read access beyond the allocated buffer.(CVE-2026-40339)\n\nlibgphoto2 is a camera access and control library. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the `ptp_unpack_OI()` function within `camlibs/ptp2/ptp-pack.c` (lines 530\u2013563). The function validates `len \u0026lt; PTP_oi_SequenceNumber` (i.e., len \u0026lt; 48) but subsequently accesses offsets 48\u201356, up to 9 bytes beyond the validated boundary, via the Samsung Galaxy 64-bit objectsize detection heuristic. An attacker can exploit this vulnerability by sending a malicious PTP ObjectInfo response, potentially leading to sensitive information disclosure or application crash.(CVE-2026-40340)\n\nlibgphoto2 is a camera access and control library. In versions up to and including 2.5.33, an out-of-bounds read vulnerability exists in the `ptp_unpack_EOS_FocusInfoEx` function. This vulnerability could be exploited by an attacker to crash libgphoto2 (Denial of Service) when processing input from untrusted USB devices.(CVE-2026-40341)",
  "id": "OESA-2026-2071",
  "modified": "2026-08-06T11:11:04Z",
  "published": "2026-04-25T11:11:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2071"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40334"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40335"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40338"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40339"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40340"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40341"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "libgphoto2 security update",
  "upstream": [
    "CVE-2026-40334",
    "CVE-2026-40335",
    "CVE-2026-40338",
    "CVE-2026-40339",
    "CVE-2026-40340",
    "CVE-2026-40341"
  ]
}

OPENSUSE-SU-2026:10916-1

Vulnerability from csaf_opensuse - Published: 2026-05-31 00:00 - Updated: 2026-09-16 21:14

Summary

libgphoto2-6-2.5.34-1.1 on GA media

Severity

Moderate

Scope

8 vulnerabilities in this advisory, including CVE-2026-40338.

CVE-2026-40338

5.2 (Medium)


                
                  CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Recommended: 36 products

Open the full advisory

ubuntu-cve-2026-40338

Vulnerability from osv_ubuntu

Published

2026-04-18 00:16

Modified

2026-07-22 18:37

Summary

Details

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in the PTP_DPFF_Enumeration case of ptp_unpack_Sony_DPD() in camlibs/ptp2/ptp-pack.c (line 856). The function reads a 2-byte enumeration count N via dtoh16o(data, *poffset) without verifying that 2 bytes remain in the buffer. The standard ptp_unpack_DPD() at line 704 has this exact check, confirming the Sony variant omitted it by oversight. Commit 3b9f9696be76ae51dca983d9dd8ce586a2561845 fixes the issue.

Severity

5.2 (Medium)


                    
                      CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-40338	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-40338	REPORT
	https://github.com/gphoto/libgphoto2/security/adv…	REPORT
	https://ubuntu.com/security/notices/USN-8586-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libgphoto2-6",
            "binary_version": "2.5.3.1-1ubuntu2.2"
          },
          {
            "binary_name": "libgphoto2-l10n",
            "binary_version": "2.5.3.1-1ubuntu2.2"
          },
          {
            "binary_name": "libgphoto2-port10",
            "binary_version": "2.5.3.1-1ubuntu2.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "libgphoto2",
        "purl": "pkg:deb/ubuntu/libgphoto2@2.5.3.1-1ubuntu2.2?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.5.2-0ubuntu5",
        "2.5.2-0ubuntu6",
        "2.5.3.1-0ubuntu1",
        "2.5.3.1-1ubuntu2",
        "2.5.3.1-1ubuntu2.2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libgphoto2-6",
            "binary_version": "2.5.9-3"
          },
          {
            "binary_name": "libgphoto2-l10n",
            "binary_version": "2.5.9-3"
          },
          {
            "binary_name": "libgphoto2-port12",
            "binary_version": "2.5.9-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "libgphoto2",
        "purl": "pkg:deb/ubuntu/libgphoto2@2.5.9-3?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.5.8-1",
        "2.5.8-2",
        "2.5.8-3",
        "2.5.9-2",
        "2.5.9-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libgphoto2-6",
            "binary_version": "2.5.16-2"
          },
          {
            "binary_name": "libgphoto2-l10n",
            "binary_version": "2.5.16-2"
          },
          {
            "binary_name": "libgphoto2-port12",
            "binary_version": "2.5.16-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "libgphoto2",
        "purl": "pkg:deb/ubuntu/libgphoto2@2.5.16-2?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.5.14-1",
        "2.5.16-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libgphoto2-6",
            "binary_version": "2.5.25-0ubuntu0.1"
          },
          {
            "binary_name": "libgphoto2-l10n",
            "binary_version": "2.5.25-0ubuntu0.1"
          },
          {
            "binary_name": "libgphoto2-port12",
            "binary_version": "2.5.25-0ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "libgphoto2",
        "purl": "pkg:deb/ubuntu/libgphoto2@2.5.25-0ubuntu0.1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.5.23-2",
        "2.5.24-1",
        "2.5.25-0ubuntu0.1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libgphoto2-6",
            "binary_version": "2.5.27-1ubuntu0.1"
          },
          {
            "binary_name": "libgphoto2-l10n",
            "binary_version": "2.5.27-1ubuntu0.1"
          },
          {
            "binary_name": "libgphoto2-port12",
            "binary_version": "2.5.27-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "libgphoto2",
        "purl": "pkg:deb/ubuntu/libgphoto2@2.5.27-1ubuntu0.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.27-1ubuntu0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.5.27-1",
        "2.5.27-1build1",
        "2.5.27-1build2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libgphoto2-6t64",
            "binary_version": "2.5.31-2.1ubuntu1.1"
          },
          {
            "binary_name": "libgphoto2-l10n",
            "binary_version": "2.5.31-2.1ubuntu1.1"
          },
          {
            "binary_name": "libgphoto2-port12t64",
            "binary_version": "2.5.31-2.1ubuntu1.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "libgphoto2",
        "purl": "pkg:deb/ubuntu/libgphoto2@2.5.31-2.1ubuntu1.1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.31-2.1ubuntu1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.5.30-1",
        "2.5.31-1",
        "2.5.31-2",
        "2.5.31-2.1build1",
        "2.5.31-2.1build2",
        "2.5.31-2.1ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libgphoto2-6t64",
            "binary_version": "2.5.31-4ubuntu1"
          },
          {
            "binary_name": "libgphoto2-l10n",
            "binary_version": "2.5.31-4ubuntu1"
          },
          {
            "binary_name": "libgphoto2-port12t64",
            "binary_version": "2.5.31-4ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "libgphoto2",
        "purl": "pkg:deb/ubuntu/libgphoto2@2.5.31-4ubuntu1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.5.31-4",
        "2.5.31-4build1",
        "2.5.31-4ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libgphoto2-6t64",
            "binary_version": "2.5.33-1ubuntu1.1"
          },
          {
            "binary_name": "libgphoto2-l10n",
            "binary_version": "2.5.33-1ubuntu1.1"
          },
          {
            "binary_name": "libgphoto2-port12t64",
            "binary_version": "2.5.33-1ubuntu1.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "libgphoto2",
        "purl": "pkg:deb/ubuntu/libgphoto2@2.5.33-1ubuntu1.1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.33-1ubuntu1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.5.31-4build1",
        "2.5.32-1",
        "2.5.33-1",
        "2.5.33-1ubuntu1"
      ]
    }
  ],
  "aliases": [],
  "details": "libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in the PTP_DPFF_Enumeration case of `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (line 856). The function reads a 2-byte enumeration count N via `dtoh16o(data, *poffset)` without verifying that 2 bytes remain in the buffer. The standard `ptp_unpack_DPD()` at line 704 has this exact check, confirming the Sony variant omitted it by oversight. Commit 3b9f9696be76ae51dca983d9dd8ce586a2561845 fixes the issue.",
  "id": "UBUNTU-CVE-2026-40338",
  "modified": "2026-07-22T18:37:17Z",
  "published": "2026-04-18T00:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-40338"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40338"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/gphoto/libgphoto2/security/advisories/GHSA-2hwp-w84q-27hf"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8586-1"
    }
  ],
  "related": [
    "USN-8586-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-40338"
  ]
}

CVE-2026-40338 (GCVE-0-2026-40338)

Tags

Sightings

Nomenclature

Related by attack behaviour

Action not permitted

CVE-2026-40338 (GCVE-0-2026-40338)

Vulnerability from osv_openeuler

Vulnerability from osv_openeuler

Vulnerability from osv_openeuler

Vulnerability from osv_openeuler

Vulnerability from osv_openeuler

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature

Related by attack behaviour