CVE-2026-40334 Details
Description
libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in ptp_unpack_Canon_FE() in camlibs/ptp2/ptp-pack.c (line 1377). The function copies a filename into a 13-byte buffer using strncpy without explicitly null-terminating the result. If the source data is exactly 13 bytes with no null terminator, the buffer is left unterminated, leading to out-of-bounds reads in any subsequent string operation. Commit 259fc7d3bfe534ce4b114c464f55b448670ab873 patches the issue.
A vulnerability exists in libgphoto2 versions through 2.5.33, where the PTP unpacking function for Canon folder entries fails to properly null-terminate filenames copied into a 13-byte buffer. This oversight allows for out-of-bounds reads in subsequent string operations, potentially leading to undefined behavior. The issue arises when a device sends a 13-byte filename without a null terminator, leaving the buffer unterminated.
Users can manually apply the suggested fix by modifying the 'ptp_unpack_Canon_FE' function to include the missing null terminator. The patched version is available in the official GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 18, 2026CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gphoto/libgphoto2/commit/259fc7d3bfe534ce4b114c464f55b448670ab873 | [email protected] | Source CodeVendor |
| https://github.com/gphoto/libgphoto2/security/advisories/GHSA-ph87-cc3j-c6hm | [email protected] | AdvisoryTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-170 | Improper Null Termination | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gphoto libgphoto2 | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 18, 2026 | New CVE Received | [email protected] |