Every CVE Search/ Get API key

CVE-2026-40333

libgphoto2 has OOB read in ptp_unpack_EOS_ImageFormat() and ptp_unpack_EOS_CustomFuncEx() due to missing length parameter in ptp-pack.c

6.1 MediumFix available

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, two functions in camlibs/ptp2/ptp-pack.c accept a data pointer but no length parameter, performing unbounded reads. Their callers in ptp_unpack_EOS_events() have xsize available but never pass it, leaving both functions unable to validate reads against the actual buffer boundary. Commit 1817ecead20c2aafa7549dac9619fe38f47b2f53 patches the issue.

Attack profile

How easy it is to exploit

Attack vector
Physical
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
High

Exploit likelihood

0.22%Up 0.2 points since Apr 18, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.1

libgphoto2 has OOB read in ptp_unpack_EOS_ImageFormat() and ptp_unpack_EOS_CustomFuncEx() due to missing length parameter in ptp-pack.c

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, two functions in camlibs/ptp2/ptp-pack.c accept a data pointer but no length parameter, performing unbounded reads. Their callers in ptp_unpack_EOS_events() have xsize available but never pass it, leaving both functions unable to validate reads against the actual buffer boundary. Commit 1817ecead20c2aafa7549dac9619fe38f47b2f53 patches the issue.

Record
CVE-2026-40333
CVSS 3.1
6.1 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
EUVDEUVD-2026-23581 6.1

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, two functions in camlibs/ptp2/ptp-pack.c accept a data pointer but no length parameter, performing unbounded reads. Their callers in ptp_unpack_EOS_events() have xsize available but never pass it, leaving both functions unable to validate reads against the actual buffer boundary. Commit 1817ecead20c2aafa7549dac9619fe38f47b2f53 patches the issue.

Record
EUVD-2026-23581
CVSS 3.1
6.1 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
NVD 6.1

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, two functions in camlibs/ptp2/ptp-pack.c accept a data pointer but no length parameter, performing unbounded reads. Their callers in ptp_unpack_EOS_events() have xsize available but never pass it, leaving both functions unable to validate reads against the actual buffer boundary. Commit 1817ecead20c2aafa7549dac9619fe38f47b2f53 patches the issue.

Record
CVE-2026-40333
CVSS 3.1
6.1 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSV 6.1

libgphoto2 has OOB read in ptp_unpack_EOS_ImageFormat() and ptp_unpack_EOS_CustomFuncEx() due to missing length parameter in ptp-pack.c

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, two functions in camlibs/ptp2/ptp-pack.c accept a data pointer but no length parameter, performing unbounded reads. Their callers in ptp_unpack_EOS_events() have xsize available but never pass it, leaving both functions unable to validate reads against the actual buffer boundary. Commit 1817ecead20c2aafa7549dac9619fe38f47b2f53 patches the issue.

Record
CVE-2026-40333
CVSS 3.1
6.1 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSVDEBIAN-CVE-2026-40333 6.1

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, two functions in camlibs/ptp2/ptp-pack.c accept a data pointer but no length parameter, performing unbounded reads. Their callers in ptp_unpack_EOS_events() have xsize available but never pass it, leaving both functions unable to validate reads against the actual buffer boundary. Commit 1817ecead20c2aafa7549dac9619fe38f47b2f53 patches the issue.

Record
DEBIAN-CVE-2026-40333
CVSS 3.1
6.1 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2785 6.1

libgphoto2 security update

is the core of gphoto2 software. It is a portable library which gives access to literally hundreds of digital cameras.

Security Fix(es):

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, two functions in camlibs/ptp2/ptp-pack.c accept a data pointer but no length parameter, performing unbounded reads. Their callers in ptp_unpack_EOS_events() have xsize available but never pass it, leaving both functions unable to validate reads against the actual buffer boundary. Commit 1817ecead20c2aafa7549dac9619fe38f47b2f53 patches the issue.(CVE-2026-40333)

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in ptp_unpack_Sony_DPD() in camlibs/ptp2/ptp-pack.c (lines 884–885). When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd->FORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation from line 857. The original array and any string values it contains are leaked on every property descriptor parse. Commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the issue.(CVE-2026-40336)

Record
OESA-2026-2785
CVSS 3.1
6.1 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2026-40333 6.1

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, two functions in camlibs/ptp2/ptp-pack.c accept a data pointer but no length parameter, performing unbounded reads. Their callers in ptp_unpack_EOS_events() have xsize available but never pass it, leaving both functions unable to validate reads against the actual buffer boundary. Commit 1817ecead20c2aafa7549dac9619fe38f47b2f53 patches the issue.

Record
UBUNTU-CVE-2026-40333
CVSS 3.1
6.1 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVAZL-83021 No score

CVE-2026-40333 affecting package libgphoto2 2.5.31-1

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, two functions in camlibs/ptp2/ptp-pack.c accept a data pointer but no length parameter, performing unbounded reads. Their callers in ptp_unpack_EOS_events() have xsize available but never pass it, leaving both functions unable to validate reads against the actual buffer boundary. Commit 1817ecead20c2aafa7549dac9619fe38f47b2f53 patches the issue.

Record
AZL-83021
Updated
2026-11-05
OSVopenSUSE-SU-2026:10916-1 No score

libgphoto2-6-2.5.34-1.1 on GA media

These are all security issues fixed in the libgphoto2-6-2.5.34-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10916-1
Updated
2026-11-02
OSVUSN-8586-1 No score

libgphoto2 vulnerabilities

It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing EOS image format data. An attacker with physical access could possibly use this issue to obtain sensitive information. (CVE-2026-40333)

It was discovered that libgphoto2 did not properly null-terminate buffers when parsing Canon folder entries. An attacker with physical access could possibly use this issue to obtain sensitive information. (CVE-2026-40334)

It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing device property values. An attacker with physical access could possibly use this issue to obtain sensitive information. (CVE-2026-40335)

It was discovered that libgphoto2 had a memory leak when parsing Sony device property descriptors. An attacker with physical access could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-40336)

It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing Sony device property enumeration data. An attacker with physical access could possibly use this issue to obtain sensitive information. (CVE-2026-40338)

It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing Sony device property form flags. An attacker with physical access could possibly use this issue to obtain sensitive information. (CVE-2026-40339)

It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing object information. An attacker with physical access could possibly use this issue to obtain sensitive information. (CVE-2026-40340)

It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing EOS focus information. An attacker with physical access could possibly use this issue to cause libgphoto2 to crash, resulting in a denial of service. (CVE-2026-40341)

Record
USN-8586-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libgphoto2
Azure Linux:3
 through 2.5.31-1 None known
libgphoto2
Debian:12
 All versions, plus listed versions
2.5.30-12.5.31-12.5.31-22.5.31-2.12.5.31-2.1~exp1
Show 6 moreShow less
2.5.31-32.5.31-42.5.32-12.5.33-12.5.34-12.5.34-2
 None known
libgphoto2
Debian:13
 All versions, plus listed versions
2.5.31-42.5.32-12.5.33-12.5.34-12.5.34-2
 None known
libgphoto2
Debian:14
 before 2.5.34-1, plus listed versions
2.5.31-42.5.32-12.5.33-1
2.5.34-1
libgphoto2
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 2.5.34-1.oe2403sp1
2.5.34-1.oe2403sp1
libgphoto2
openEuler:24.03-LTS-SP3
From an advisory covering 2 CVEs
 before 2.5.34-1.oe2403sp3
2.5.34-1.oe2403sp3
libgphoto2
openEuler:20.03-LTS-SP4
From an advisory covering 2 CVEs
 before 2.5.34-1.oe2003sp4
2.5.34-1.oe2003sp4
libgphoto2
openEuler:22.03-LTS-SP4
From an advisory covering 2 CVEs
 before 2.5.34-1.oe2203sp4
2.5.34-1.oe2203sp4
libgphoto2
Ubuntu:14.04:LTS
 All versions, plus listed versions
2.5.2-0ubuntu52.5.2-0ubuntu62.5.3.1-0ubuntu12.5.3.1-1ubuntu22.5.3.1-1ubuntu2.2
 None known
libgphoto2
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.5.8-12.5.8-22.5.8-32.5.9-22.5.9-3
 None known
Show 10 moreShow less
Affected packages
PackageAffectedFixed
libgphoto2
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.5.14-12.5.16-2
 None known
libgphoto2
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.5.23-22.5.24-12.5.25-0ubuntu0.1
 None known
libgphoto2
Ubuntu:22.04:LTS
 before 2.5.27-1ubuntu0.1, plus listed versions
2.5.27-12.5.27-1build12.5.27-1build2
2.5.27-1ubuntu0.1
libgphoto2
Ubuntu:24.04:LTS
 before 2.5.31-2.1ubuntu1.1, plus listed versions
2.5.30-12.5.31-12.5.31-22.5.31-2.1build12.5.31-2.1build22.5.31-2.1ubuntu1
2.5.31-2.1ubuntu1.1
libgphoto2
Ubuntu:25.10
 All versions, plus listed versions
2.5.31-42.5.31-4build12.5.31-4ubuntu1
 None known
libgphoto2
Ubuntu:26.04:LTS
 before 2.5.33-1ubuntu1.1, plus listed versions
2.5.31-4build12.5.32-12.5.33-12.5.33-1ubuntu1
2.5.33-1ubuntu1.1
libgphoto2
Ubuntu:22.04:LTS
From an advisory covering 8 CVEs
 before 2.5.27-1ubuntu0.1, plus listed versions
2.5.27-12.5.27-1build12.5.27-1build2
2.5.27-1ubuntu0.1
libgphoto2
Ubuntu:24.04:LTS
From an advisory covering 8 CVEs
 before 2.5.31-2.1ubuntu1.1, plus listed versions
2.5.30-12.5.31-12.5.31-22.5.31-2.1build12.5.31-2.1build22.5.31-2.1ubuntu1
2.5.31-2.1ubuntu1.1
libgphoto2
Ubuntu:26.04:LTS
From an advisory covering 8 CVEs
 before 2.5.33-1ubuntu1.1, plus listed versions
2.5.31-4build12.5.32-12.5.33-12.5.33-1ubuntu1
2.5.33-1ubuntu1.1
libgphoto2
openSUSE:Tumbleweed
From an advisory covering 8 CVEs
 before 2.5.34-1.1
2.5.34-1.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-40333 is a medium vulnerability (CVSS 6.1) in Gphoto Libgphoto2, published April 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in libgphoto2 2.5.34-1.

References

Show 19 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open