Memory Leak in libgphoto2 Camera Control Library Affects Sony Devices

CVE-2026-40336

What is CVE-2026-40336?

The libgphoto2 camera access and control library has a vulnerability that leads to a memory leak within the function ptp_unpack_Sony_DPD(). This issue primarily affects versions up to 2.5.33. When handling a secondary enumeration list introduced in newer Sony cameras, the library fails to free the previously allocated memory before reallocating new memory. This oversight causes a continuous memory leak during property descriptor parsing, leading to potential performance degradation and increased memory usage over time. The issue has been addressed in commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6, highlighting the importance of keeping library versions updated.

References