PT-2026-33536 · Gphotos · Libgphoto2

Published 2026-04-17 · Updated 2026-04-18 · CVE-2026-40338

NVD

CVSS v3.1

5.2

Medium

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in the PTP DPFF Enumeration case of ptp unpack Sony DPD() in camlibs/ptp2/ptp-pack.c (line 856). The function reads a 2-byte enumeration count N via dtoh16o(data, *poffset) without verifying that 2 bytes remain in the buffer. The standard ptp unpack DPD() at line 704 has this exact check, confirming the Sony variant omitted it by oversight. Commit 3b9f9696be76ae51dca983d9dd8ce586a2561845 fixes the issue.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-40338

Affected Products

Libgphoto2

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-40338 · Security Note
• https://github.com/gphoto/libgphoto2/commit/3b9f9696be76ae51dca983d9dd8ce586a2561845 · Note
• https://github.com/gphoto/libgphoto2/security/advisories/GHSA-2hwp-w84q-27hf · Note