Heap Out-of-Bounds Vulnerability in libgphoto2 by gPhoto
CVE-2026-120452

5.2MEDIUM

Key Information:

Vendor

Gphoto

Status
Libgphoto2
Vendor
CVE Published:
2 November 2026

What is CVE-2026-120452?

The vulnerability found in libgphoto2 versions up to 2.5.34 involves a heap out-of-bounds read and write issue specifically in the jl2005bcd_decompress() function. Malicious USB cameras can exploit this vulnerability by providing specially crafted thumbnail headers and allocation-table values, leading to heap memory corruption. This exploitation results in an in-place byte-swapping scenario, allowing attackers to leak sensitive heap contents through preview images, significantly compromising the integrity of the affected systems.

Affected Version(s)

libgphoto2 0 <= 2.5.34

References

https://github.com/gphoto/libgphoto2/issues/1326
issue-tracking
https://github.com/gphoto/libgphoto2/commit/af3b8e9c542cd...
patch
https://github.com/gphoto/libgphoto2/commit/30bf7ace6d47c...
patch

CVSS V4

Score:
5.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
TheProtagonist07
.