PT-2026-33523 · Gphotos · Libgphoto2

Published 2026-04-17 · Updated 2026-04-18 · CVE-2026-40333

Mitre

CVSS v3.1

6.1

Medium

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, two functions in camlibs/ptp2/ptp-pack.c accept a data pointer but no length parameter, performing unbounded reads. Their callers in ptp unpack EOS events() have xsize available but never pass it, leaving both functions unable to validate reads against the actual buffer boundary. Commit 1817ecead20c2aafa7549dac9619fe38f47b2f53 patches the issue.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-40333

Affected Products

Libgphoto2

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-40333 · Security Note
• https://github.com/gphoto/libgphoto2/commit/1817ecead20c2aafa7549dac9619fe38f47b2f53 · Note
• https://github.com/gphoto/libgphoto2/security/advisories/GHSA-hq94-cp6h-3gjp · Note