{"id":"CVE-2026-40336","aliases":["AZL-83009","DEBIAN-CVE-2026-40336","EUVD-2026-23587","GHSA-g8xw-p5wj-mrxv","OESA-2026-2785","UBUNTU-CVE-2026-40336","USN-8586-1","openSUSE-SU-2026:10916-1"],"status":"published","title":"libgphoto2 has memory leak in ptp_unpack_Sony_DPD() secondary enumeration list in ptp-pack.c","description":"libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (lines 884–885). When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd-\u003eFORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation from line 857. The original array and any string values it contains are leaked on every property descriptor parse. Commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the issue.","severity":{"version":"3.1","score":2.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00181,"percentile":0.07722,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-401"],"published":"2026-04-17T23:27:42Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Debian:14","package":"libgphoto2","fixed_in":["2.5.34-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libgphoto2","fixed_in":["2.5.33-1ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"libgphoto2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.5.31-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libgphoto2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.30-1","2.5.31-1","2.5.31-2","2.5.31-2.1","2.5.31-2.1~exp1","2.5.31-3","2.5.31-4","2.5.32-1","2.5.33-1","2.5.34-1","2.5.34-2"]},{"source":"osv","ecosystem":"Debian:13","package":"libgphoto2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.31-4","2.5.32-1","2.5.33-1","2.5.34-1","2.5.34-2"]},{"source":"osv","ecosystem":"Debian:14","package":"libgphoto2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.34-1"}]}],"versions":["2.5.31-4","2.5.32-1","2.5.33-1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libgphoto2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.34-1.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libgphoto2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.34-1.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libgphoto2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.34-1.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libgphoto2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.34-1.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libgphoto2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.31-4","2.5.31-4build1","2.5.31-4ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libgphoto2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.33-1ubuntu1.1"}]}],"versions":["2.5.31-4build1","2.5.32-1","2.5.33-1","2.5.33-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libgphoto2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.27-1ubuntu0.1"}]}],"versions":["2.5.27-1","2.5.27-1build1","2.5.27-1build2"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libgphoto2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.31-2.1ubuntu1.1"}]}],"versions":["2.5.30-1","2.5.31-1","2.5.31-2","2.5.31-2.1build1","2.5.31-2.1build2","2.5.31-2.1ubuntu1"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libgphoto2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.33-1ubuntu1.1"}]}],"versions":["2.5.31-4build1","2.5.32-1","2.5.33-1","2.5.33-1ubuntu1"],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libgphoto2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.34-1.1"}]}],"bundled":8}],"products":[{"vendor":"gphoto","product":"libgphoto2"}],"references":[{"url":"https://github.com/gphoto/libgphoto2/security/advisories/GHSA-g8xw-p5wj-mrxv","tags":["x_refsource_CONFIRM","advisory","report"]},{"url":"https://github.com/gphoto/libgphoto2/commit/404ff02c75f3cb280196fc260a63c4d26cf1a8f6","tags":["x_refsource_MISC","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40336","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40336.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-40336","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2785","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40333","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-40336","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40336","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8586-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-40333","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40334","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40335","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40338","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40339","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40340","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40341","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40333","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40334","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40335","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40341","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-40336","title":"libgphoto2 has memory leak in ptp_unpack_Sony_DPD() secondary enumeration list in ptp-pack.c","description":"libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (lines 884–885). When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd-\u003eFORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation from line 857. The original array and any string values it contains are leaked on every property descriptor parse. Commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the issue.","status":"published","published":"2026-04-17T23:27:42.868Z","modified":"2026-04-20T16:14:53.071Z","cvss":[{"version":"3.1","score":2.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T13:43:11.445168Z"}],"euvd":[{"id":"EUVD-2026-23587","description":"libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (lines 884–885). When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd-\u003eFORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation from line 857. The original array and any string values it contains are leaked on every property descriptor parse. Commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the issue.","status":"published","published":"2026-04-17T23:27:42Z","modified":"2026-04-20T16:14:53Z","cvss":[{"version":"3.1","score":2.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T19:24:22.446697Z"}],"nvd":[{"id":"CVE-2026-40336","description":"libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (lines 884–885). When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd-\u003eFORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation from line 857. The original array and any string values it contains are leaked on every property descriptor parse. Commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the issue.","status":"published","published":"2026-04-18T00:16:37.523Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":2.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:12:15.120927Z"}],"osv":[{"id":"CVE-2026-40336","title":"libgphoto2 has memory leak in ptp_unpack_Sony_DPD() secondary enumeration list in ptp-pack.c","description":"libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (lines 884–885). When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd-\u003eFORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation from line 857. The original array and any string values it contains are leaked on every property descriptor parse. Commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the issue.","status":"published","published":"2026-04-17T23:27:42.868Z","modified":"2026-10-28T10:55:09.567866378Z","cvss":[{"version":"3.1","score":2.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T15:45:03.424067Z"},{"id":"DEBIAN-CVE-2026-40336","description":"libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (lines 884–885). When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd-\u003eFORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation from line 857. The original array and any string values it contains are leaked on every property descriptor parse. Commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the issue.","status":"published","published":"2026-04-18T00:16:37.523Z","modified":"2026-10-27T09:47:33.461417272Z","cvss":[{"version":"3.1","score":2.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"OESA-2026-2785","title":"libgphoto2 security update","description":"is the core of gphoto2 software. It is a portable library which gives access to literally hundreds of digital cameras.\r\n\r\nSecurity Fix(es):\n\nlibgphoto2 is a camera access and control library. In versions up to and including 2.5.33, two functions in camlibs/ptp2/ptp-pack.c accept a data pointer but no length parameter, performing unbounded reads. Their callers in ptp_unpack_EOS_events() have xsize available but never pass it, leaving both functions unable to validate reads against the actual buffer boundary. Commit 1817ecead20c2aafa7549dac9619fe38f47b2f53 patches the issue.(CVE-2026-40333)\n\nlibgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (lines 884–885). When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd-\u0026gt;FORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation from line 857. The original array and any string values it contains are leaked on every property descriptor parse. Commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the issue.(CVE-2026-40336)","status":"published","published":"2026-06-24T11:11:42Z","modified":"2026-08-18T01:21:12.15870953Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"UBUNTU-CVE-2026-40336","description":"libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (lines 884–885). When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd-\u003eFORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation from line 857. The original array and any string values it contains are leaked on every property descriptor parse. Commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the issue.","status":"published","published":"2026-04-18T00:16:00Z","modified":"2026-07-22T20:45:25.531873736Z","cvss":[{"version":"3.1","score":2.4,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"AZL-83009","title":"CVE-2026-40336 affecting package libgphoto2 2.5.31-1","description":"libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (lines 884–885). When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd-\u003eFORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation from line 857. The original array and any string values it contains are leaked on every property descriptor parse. Commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the issue.","status":"published","published":"2026-04-18T00:16:37Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.988217Z"},{"id":"openSUSE-SU-2026:10916-1","title":"libgphoto2-6-2.5.34-1.1 on GA media","description":"These are all security issues fixed in the libgphoto2-6-2.5.34-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-31T00:00:00Z","modified":"2026-06-01T07:45:13.361348687Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"USN-8586-1","title":"libgphoto2 vulnerabilities","description":"It was discovered that libgphoto2 did not properly validate buffer\nboundaries when parsing EOS image format data. An attacker with physical\naccess could possibly use this issue to obtain sensitive information.\n(CVE-2026-40333)\n\nIt was discovered that libgphoto2 did not properly null-terminate buffers\nwhen parsing Canon folder entries. An attacker with physical access could\npossibly use this issue to obtain sensitive information. (CVE-2026-40334)\n\nIt was discovered that libgphoto2 did not properly validate buffer\nboundaries when parsing device property values. An attacker with physical\naccess could possibly use this issue to obtain sensitive information.\n(CVE-2026-40335)\n\nIt was discovered that libgphoto2 had a memory leak when parsing Sony\ndevice property descriptors. An attacker with physical access could\npossibly use this issue to cause a denial of service. This issue only\naffected Ubuntu 26.04 LTS. (CVE-2026-40336)\n\nIt was discovered that libgphoto2 did not properly validate buffer\nboundaries when parsing Sony device property enumeration data. An attacker\nwith physical access could possibly use this issue to obtain sensitive\ninformation. (CVE-2026-40338)\n\nIt was discovered that libgphoto2 did not properly validate buffer\nboundaries when parsing Sony device property form flags. An attacker with\nphysical access could possibly use this issue to obtain sensitive\ninformation. (CVE-2026-40339)\n\nIt was discovered that libgphoto2 did not properly validate buffer\nboundaries when parsing object information. An attacker with physical\naccess could possibly use this issue to obtain sensitive information.\n(CVE-2026-40340)\n\nIt was discovered that libgphoto2 did not properly validate buffer\nboundaries when parsing EOS focus information. An attacker with physical\naccess could possibly use this issue to cause libgphoto2 to crash,\nresulting in a denial of service. (CVE-2026-40341)","status":"published","published":"2026-07-22T13:11:45Z","modified":"2026-07-22T20:59:36.485849007Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}