CVE-2026-40339 Details
Description
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (line 842). The function reads the FormFlag byte via `dtoh8o(data, *poffset)` without a prior bounds check. The standard `ptp_unpack_DPD()` at lines 686–687 correctly validates `*offset + sizeof(uint8_t) > dpdlen` before this same read, but the Sony variant omits this check entirely. Commit 09f8a940b1e418b5693f5c11e3016a1ad2cea62d fixes the issue.
A moderate out-of-bounds read vulnerability has been identified in libgphoto2 versions through 2.5.33. The issue arises in the ptp_unpack_Sony_DPD() function within camlibs/ptp2/ptp-pack.c, specifically at line 842. This function reads the FormFlag byte using dtoh8o(data, *poffset) without performing a prior bounds check. In contrast, the standard ptp_unpack_DPD() function correctly validates the offset before the read. The vulnerability can be exploited when a rogue PTP/IP server or malicious USB device sends a crafted Device Property Descriptor with a truncated buffer, causing the function to read beyond the buffer boundary and expose adjacent heap memory.
Users can update to the patched version of libgphoto2, which includes the necessary bounds check in the ptp_unpack_Sony_DPD() function. Instructions for updating can be found in the libgphoto2 repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 18, 2026CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gphoto/libgphoto2/commit/09f8a940b1e418b5693f5c11e3016a1ad2cea62d | [email protected] | Source CodeVendor |
| https://github.com/gphoto/libgphoto2/security/advisories/GHSA-42cm-m9hc-r7q8 | [email protected] | AdvisoryTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| libgphoto2 | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 18, 2026 | New CVE Received | [email protected] |