PT-2026-33530 · Unknown · Libgphoto2

Published 2026-04-17 · Updated 2026-04-20 · CVE-2026-40336

Positive Technologies (AI Summary)

CVSS v3.1

2.4

Low

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions libgphoto2 versions prior to 2.5.34

Description A memory leak exists in the ptp unpack Sony DPD() function within camlibs/ptp2/ptp-pack.c. When processing a secondary enumeration list used in 2024+ Sony cameras, the function overwrites the dpd->FORM.Enum.SupportedValue variable with a new allocation without freeing the previous one. This results in the original array and its string values being leaked during every property descriptor parse.

Recommendations Update to version 2.5.34 or later.

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2026-40336

Affected Products

Libgphoto2

References · 10

• https://security-tracker.debian.org/tracker/CVE-2026-40336 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-40336 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-40336 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-40336 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40336 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40336 · Vendor Advisory
• https://github.com/gphoto/libgphoto2/security/advisories/GHSA-g8xw-p5wj-mrxv · Note
• https://github.com/gphoto/libgphoto2/commit/404ff02c75f3cb280196fc260a63c4d26cf1a8f6 · Note
• https://twitter.com/VulmonFeeds/status/2045357881373909425 · Twitter Post
• https://twitter.com/CVEnew/status/2045467355472408684 · Twitter Post