CVE-2026-40333 Details
Description
libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, two functions in camlibs/ptp2/ptp-pack.c accept a data pointer but no length parameter, performing unbounded reads. Their callers in ptp_unpack_EOS_events() have xsize available but never pass it, leaving both functions unable to validate reads against the actual buffer boundary. Commit 1817ecead20c2aafa7549dac9619fe38f47b2f53 patches the issue.
A vulnerability exists in libgphoto2 versions through 2.5.33, specifically within the Canon EOS event handling functions of the PTP2 camera library. The functions 'ptp_unpack_EOS_ImageFormat' and 'ptp_unpack_EOS_CustomFuncEx' accept data pointers without corresponding length parameters, leading to unbounded read operations. Although the calling function 'ptp_unpack_EOS_events' has access to the data size, it fails to pass this information, allowing both unpacking functions to read beyond the actual buffer limits. This oversight can result in the disclosure of adjacent heap memory.
Users can update to the latest version of libgphoto2, where this vulnerability has been addressed. Instructions for updating can be found in the libgphoto2 documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 18, 2026CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gphoto/libgphoto2/commit/1817ecead20c2aafa7549dac9619fe38f47b2f53 | [email protected] | Source CodeVendor |
| https://github.com/gphoto/libgphoto2/security/advisories/GHSA-hq94-cp6h-3gjp | [email protected] | AdvisoryTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gphoto libgphoto2 | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 18, 2026 | New CVE Received | [email protected] |