CVE-2026-40336
libgphoto2 has memory leak in ptp_unpack_Sony_DPD() secondary enumeration list in ptp-pack.c
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in ptp_unpack_Sony_DPD() in camlibs/ptp2/ptp-pack.c (lines 884–885). When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd->FORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation from line 857. The original array and any string values it contains are leaked on every property descriptor parse. Commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Physical
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
libgphoto2 has memory leak in ptp_unpack_Sony_DPD() secondary enumeration list in ptp-pack.c
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in ptp_unpack_Sony_DPD() in camlibs/ptp2/ptp-pack.c (lines 884–885). When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd->FORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation from line 857. The original array and any string values it contains are leaked on every property descriptor parse. Commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the issue.
- Record
CVE-2026-40336- CVSS 3.1
- 2.4 Low
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-401
- Updated
- 2026-11-02
EUVDEUVD-2026-23587
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in ptp_unpack_Sony_DPD() in camlibs/ptp2/ptp-pack.c (lines 884–885). When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd->FORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation from line 857. The original array and any string values it contains are leaked on every property descriptor parse. Commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the issue.
- Record
EUVD-2026-23587- CVSS 3.1
- 2.4 Low
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
NVD
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in ptp_unpack_Sony_DPD() in camlibs/ptp2/ptp-pack.c (lines 884–885). When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd->FORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation from line 857. The original array and any string values it contains are leaked on every property descriptor parse. Commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the issue.
- Record
CVE-2026-40336- CVSS 3.1
- 2.4 Low
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-401
- Updated
- 2026-11-02
OSV
libgphoto2 has memory leak in ptp_unpack_Sony_DPD() secondary enumeration list in ptp-pack.c
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in ptp_unpack_Sony_DPD() in camlibs/ptp2/ptp-pack.c (lines 884–885). When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd->FORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation from line 857. The original array and any string values it contains are leaked on every property descriptor parse. Commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the issue.
- Record
CVE-2026-40336- CVSS 3.1
- 2.4 Low
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-401
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-40336
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in ptp_unpack_Sony_DPD() in camlibs/ptp2/ptp-pack.c (lines 884–885). When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd->FORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation from line 857. The original array and any string values it contains are leaked on every property descriptor parse. Commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the issue.
- Record
DEBIAN-CVE-2026-40336- CVSS 3.1
- 2.4 Low
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVOESA-2026-2785
libgphoto2 security update
is the core of gphoto2 software. It is a portable library which gives access to literally hundreds of digital cameras.
Security Fix(es):
libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, two functions in camlibs/ptp2/ptp-pack.c accept a data pointer but no length parameter, performing unbounded reads. Their callers in ptp_unpack_EOS_events() have xsize available but never pass it, leaving both functions unable to validate reads against the actual buffer boundary. Commit 1817ecead20c2aafa7549dac9619fe38f47b2f53 patches the issue.(CVE-2026-40333)
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in ptp_unpack_Sony_DPD() in camlibs/ptp2/ptp-pack.c (lines 884–885). When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd->FORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation from line 857. The original array and any string values it contains are leaked on every property descriptor parse. Commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the issue.(CVE-2026-40336)
- Record
OESA-2026-2785- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2026-40336
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in ptp_unpack_Sony_DPD() in camlibs/ptp2/ptp-pack.c (lines 884–885). When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd->FORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation from line 857. The original array and any string values it contains are leaked on every property descriptor parse. Commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the issue.
- Record
UBUNTU-CVE-2026-40336- CVSS 3.1
- 2.4 Low
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVAZL-83009 No score
CVE-2026-40336 affecting package libgphoto2 2.5.31-1
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in ptp_unpack_Sony_DPD() in camlibs/ptp2/ptp-pack.c (lines 884–885). When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd->FORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation from line 857. The original array and any string values it contains are leaked on every property descriptor parse. Commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the issue.
- Record
AZL-83009- Updated
- 2026-11-05
OSVopenSUSE-SU-2026:10916-1 No score
libgphoto2-6-2.5.34-1.1 on GA media
These are all security issues fixed in the libgphoto2-6-2.5.34-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10916-1- Updated
- 2026-11-02
OSVUSN-8586-1 No score
libgphoto2 vulnerabilities
It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing EOS image format data. An attacker with physical access could possibly use this issue to obtain sensitive information. (CVE-2026-40333)
It was discovered that libgphoto2 did not properly null-terminate buffers when parsing Canon folder entries. An attacker with physical access could possibly use this issue to obtain sensitive information. (CVE-2026-40334)
It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing device property values. An attacker with physical access could possibly use this issue to obtain sensitive information. (CVE-2026-40335)
It was discovered that libgphoto2 had a memory leak when parsing Sony device property descriptors. An attacker with physical access could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-40336)
It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing Sony device property enumeration data. An attacker with physical access could possibly use this issue to obtain sensitive information. (CVE-2026-40338)
It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing Sony device property form flags. An attacker with physical access could possibly use this issue to obtain sensitive information. (CVE-2026-40339)
It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing object information. An attacker with physical access could possibly use this issue to obtain sensitive information. (CVE-2026-40340)
It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing EOS focus information. An attacker with physical access could possibly use this issue to cause libgphoto2 to crash, resulting in a denial of service. (CVE-2026-40341)
- Record
USN-8586-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libgphoto2Azure Linux:3 |
through 2.5.31-1 | None known |
libgphoto2Debian:12 |
All versions, plus listed versions 2.5.30-12.5.31-12.5.31-22.5.31-2.12.5.31-2.1~exp1 Show 6 moreShow less2.5.31-32.5.31-42.5.32-12.5.33-12.5.34-12.5.34-2 |
None known |
libgphoto2Debian:13 |
All versions, plus listed versions 2.5.31-42.5.32-12.5.33-12.5.34-12.5.34-2 |
None known |
libgphoto2Debian:14 |
before 2.5.34-1, plus listed versions 2.5.31-42.5.32-12.5.33-1 |
2.5.34-1 |
libgphoto2openEuler:24.03-LTS-SP1 From an advisory covering 2 CVEs |
before 2.5.34-1.oe2403sp1 | 2.5.34-1.oe2403sp1 |
libgphoto2openEuler:24.03-LTS-SP3 From an advisory covering 2 CVEs |
before 2.5.34-1.oe2403sp3 | 2.5.34-1.oe2403sp3 |
libgphoto2openEuler:20.03-LTS-SP4 From an advisory covering 2 CVEs |
before 2.5.34-1.oe2003sp4 | 2.5.34-1.oe2003sp4 |
libgphoto2openEuler:22.03-LTS-SP4 From an advisory covering 2 CVEs |
before 2.5.34-1.oe2203sp4 | 2.5.34-1.oe2203sp4 |
libgphoto2Ubuntu:25.10 |
All versions, plus listed versions 2.5.31-42.5.31-4build12.5.31-4ubuntu1 |
None known |
libgphoto2Ubuntu:26.04:LTS |
before 2.5.33-1ubuntu1.1, plus listed versions 2.5.31-4build12.5.32-12.5.33-12.5.33-1ubuntu1 |
2.5.33-1ubuntu1.1 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libgphoto2Ubuntu:22.04:LTS From an advisory covering 8 CVEs |
before 2.5.27-1ubuntu0.1, plus listed versions 2.5.27-12.5.27-1build12.5.27-1build2 |
2.5.27-1ubuntu0.1 |
libgphoto2Ubuntu:24.04:LTS From an advisory covering 8 CVEs |
before 2.5.31-2.1ubuntu1.1, plus listed versions 2.5.30-12.5.31-12.5.31-22.5.31-2.1build12.5.31-2.1build22.5.31-2.1ubuntu1 |
2.5.31-2.1ubuntu1.1 |
libgphoto2Ubuntu:26.04:LTS From an advisory covering 8 CVEs |
before 2.5.33-1ubuntu1.1, plus listed versions 2.5.31-4build12.5.32-12.5.33-12.5.33-1ubuntu1 |
2.5.33-1ubuntu1.1 |
libgphoto2openSUSE:Tumbleweed From an advisory covering 8 CVEs |
before 2.5.34-1.1 | 2.5.34-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40336 is a low vulnerability (CVSS 2.4) in Gphoto Libgphoto2, published April 17, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. Fixed in libgphoto2 2.5.34-1.
References
github.com/gphoto/libgphoto2/security/advisories/GHSA-g8xw-p5wj-mrxv
nvd.nist.gov/vuln/detail/CVE-2026-40336
security-tracker.debian.org/tracker/CVE-2026-40336
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-2785
Show 19 moreShow less
ubuntu.com/security/CVE-2026-40336
cve.org/CVERecord?id=CVE-2026-40336
suse.com/security/cve/CVE-2026-40333