CVE-2026-40341

libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd_decompress(). Malicious USB cameras can supply small allocation-table values and a thumbnail header byte so in-place byte-swapping exceeds the buffer by about 30 KB, leaking heap contents in preview images.

libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005c_init(). Malicious USB devices can supply an unbounded allocation table entry count to overwrite the saved return address and heap data, potentially achieving code execution.

libgphoto2 versions up to and including 2.5.33 have an out-of-bounds read vulnerability in ptp_unpack_OI() in camlibs/ptp2/ptp-pack.c (lines 530–563). The function validates len < PTP_oi_SequenceNumber (i.e., len < 48) but subsequently accesses offsets 48–56, up to 9 bytes beyond the validated boundary, via the Samsung Galaxy 64-bit objectsize detection heuristic. Commit 7c7f515bc88c3d0c4098ac965d313518e0ccbe33 fixes the issue.

libgphoto2 versions up to and including 2.5.33 have an out-of-bounds read in ptp_unpack_Sony_DPD() in camlibs/ptp2/ptp-pack.c. The function reads the FormFlag byte without a prior bounds check, unlike the standard ptp_unpack_DPD() which performs this validation.

libgphoto2 up to and including 2.5.33 has an out-of-bounds read in the PTP_DPFF_Enumeration case of ptp_unpack_Sony_DPD() in camlibs/ptp2/ptp-pack.c (line 856). The function reads a 2-byte enumeration count N via dtoh16o(data, *poffset) without verifying that 2 bytes remain in the buffer. The standard ptp_unpack_DPD() at line 704 has this check, confirming the Sony variant omitted it by oversight. Commit 3b9f9696be76ae51dca983d9dd8ce586a2561845 fixes the issue.

libgphoto2 versions up to and including 2.5.33 have a memory leak in ptp_unpack_Sony_DPD() in camlibs/ptp2/ptp-pack.c. When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd->FORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation, leaking the array and its strings on every property descriptor parse.

libgphoto2 versions up to and including 2.5.33 have an out-of-bounds read in ptp_unpack_DPV() in camlibs/ptp2/ptp-pack.c. The UINT128 and INT128 cases advance the offset by 16 bytes without verifying that 16 bytes remain in the buffer.

libgphoto2 up to and including 2.5.33 has a missing null terminator in ptp_unpack_Canon_FE() in camlibs/ptp2/ptp-pack.c (line 1377). The function copies a filename into a 13-byte buffer using strncpy without explicitly null-terminating it; if the source is exactly 13 bytes with no null terminator, the buffer is left unterminated, leading to out-of-bounds reads in subsequent string operations. Commit 259fc7d3bfe534ce4b114c464f55b448670ab873 patches the issue.

libgphoto2 versions up to and including 2.5.33 have two functions in camlibs/ptp2/ptp-pack.c that accept a data pointer but no length parameter, performing unbounded reads. Their callers in ptp_unpack_EOS_events() have xsize available but never pass it, leaving both functions unable to validate reads against the actual buffer boundary. Commit 1817ecead20c2aafa7549dac9619fe38f47b2f53 patches the issue.