CVE-2026-40336 Details
Description
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (lines 884–885). When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd->FORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation from line 857. The original array and any string values it contains are leaked on every property descriptor parse. Commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the issue.
A memory leak vulnerability has been identified in libgphoto2 versions through 2.5.33. The issue arises in the PTP unpacking function for Sony devices, specifically when processing secondary enumeration lists from 2024 and later models. The vulnerability occurs because the function overwrites the 'SupportedValue' field with a new allocation without freeing the previous one, leading to a leak of the original array and any string values it contained during each property descriptor parsing. This flaw can be exploited by a malicious device to send repeated property descriptor responses, causing unbounded memory growth and eventual exhaustion of resources in the host process.
Users can apply the patch available in commit 404ff02 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 18, 2026CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gphoto/libgphoto2/commit/404ff02c75f3cb280196fc260a63c4d26cf1a8f6 | [email protected] | Source CodeVendor |
| https://github.com/gphoto/libgphoto2/security/advisories/GHSA-g8xw-p5wj-mrxv | [email protected] | AdvisoryTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gphoto libgphoto2 | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 18, 2026 | New CVE Received | [email protected] |