Out-of-Bounds Read Vulnerability in libgphoto2 Affecting Camera Access by gPhoto

CVE-2026-40338

What is CVE-2026-40338?

An out-of-bounds read vulnerability exists in libgphoto2, a library used for camera access and control. In versions up to and including 2.5.33, the function ptp_unpack_Sony_DPD() fails to validate the buffer size before reading a 2-byte enumeration count. This omission could potentially lead to security concerns, allowing unauthorized access to memory regions. The issue has been addressed in a commit that adds the necessary checks to ensure buffer safety.

References