CVE-2026-40335 Details
Description
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in `ptp_unpack_DPV()` in `camlibs/ptp2/ptp-pack.c` (lines 622–629). The UINT128 and INT128 cases advance `*offset += 16` without verifying that 16 bytes remain in the buffer. The entry check at line 609 only guarantees `*offset < total` (at least 1 byte available), leaving up to 15 bytes unvalidated. Commit 433bde9888d70aa726e32744cd751d7dbe94379a patches the issue.
A moderate out-of-bounds read vulnerability has been identified in libgphoto2, a library for camera access and control. This issue affects versions of libgphoto2 through 2.5.33. The vulnerability arises in the PTP unpacking function 'ptp_unpack_DPV()', specifically within the 'camlibs/ptp2/ptp-pack.c' file, lines 622 to 629. The problem occurs when the function processes data types PTP_DTC_UINT128 and PTP_DTC_INT128'. The function advances the offset by 16 bytes without first verifying that enough bytes remain in the buffer. Although there is an initial check to ensure the offset is within bounds, it only guarantees at least one byte is available, leaving a potential 15 bytes unvalidated. This oversight can be exploited by a malicious PTP/IP server or USB device that sends a crafted Device Property Value, causing the offset to exceed the buffer limit and bypassing intended safety checks.
Users can apply the patch available in commit 433bde9888d70aa726e32744cd751d7dbe94379a, which adds the necessary bounds checks before advancing the offset for UINT128 and INT128 datatypes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 18, 2026CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gphoto/libgphoto2/commit/433bde9888d70aa726e32744cd751d7dbe94379a | [email protected] | Source CodeVendor |
| https://github.com/gphoto/libgphoto2/security/advisories/GHSA-g4g5-c2x9-cqfj | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libgphoto2 | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 18, 2026 | New CVE Received | [email protected] |