CVE-2026-120452 in libgphoto2
Summary
by MITRE • 11/02/2026
libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd_decompress() that allows malicious USB cameras to corrupt heap memory via oversized thumbnail processing. Attackers can supply small allocation-table values and a thumbnail header byte so in-place byte-swapping exceeds the buffer by about 30 KB, leaking heap contents in preview images.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified within libgphoto2 versions up through 2.5.34 represents a critical memory safety failure located specifically within the jl2005bcd_decompress function. This component is responsible for handling image data from specific JPEG-like camera models, and it fails to adequately validate input parameters before performing in-place byte-swapping operations on thumbnail headers. The core technical flaw stems from an insufficient check of allocation-table values provided by the connected device. When a malicious USB camera supplies crafted small allocation-table values alongside a specifically constructed thumbnail header byte, the decompression logic miscalculates the required buffer size or bounds for the operation. This miscalculation leads to heap out-of-bounds read and write conditions during the processing of oversized thumbnails. The attacker can control these inputs by connecting a compromised peripheral device that mimics legitimate camera hardware but sends malformed data structures designed to exploit this logic error in the decompression routine.
The operational impact of this vulnerability is severe due to its potential for both information disclosure and arbitrary code execution. By triggering an out-of-bounds read, an attacker can cause the application to leak sensitive heap contents into preview images or other output streams. This data leakage can reveal internal state information, cryptographic keys, or user credentials stored in adjacent memory regions. Furthermore, the associated heap write vulnerability allows for potential corruption of heap metadata and arbitrary data structures. In a context where libgphoto2 is used by desktop applications to manage digital cameras, this could allow an attacker who has physical access to plug in a malicious device to execute code with the privileges of the user running the application. This aligns closely with CWE-125 Out-of-bounds Read and CWE-787 Out-of-bounds Write, highlighting fundamental memory management failures that are prevalent in C-based libraries handling untrusted input from hardware peripherals.
From a threat modeling perspective, this vulnerability facilitates attacks categorized under ATT&CK technique T1059 Command and Scripting Interpreter if code execution is achieved, or T1005 Data from Local System for information disclosure scenarios. The attack vector requires physical proximity to the target system, classifying it as an adjacent network or local access scenario rather than a remote exploit over the internet. However, given the prevalence of USB-connected cameras and scanners in professional environments such as newsrooms, photography studios, and government facilities, the risk surface is significant. An attacker could disguise malicious hardware as standard imaging equipment to bypass initial security controls that may not inspect peripheral data streams with sufficient depth.
Mitigation strategies must focus on both immediate patching and long-term architectural improvements. The primary defense is to upgrade libgphoto2 to a version newer than 2.5.34, where the jl2005bcd_decompress function has been patched to enforce strict bounds checking before performing byte-swapping operations. Developers should ensure that all allocation-table values are validated against expected maximums and that buffer sizes are calculated conservatively based on actual data lengths rather than potentially malicious header fields. For organizations unable to patch immediately, implementing USB device filtering policies can restrict the types of peripherals allowed to connect to critical systems. Additionally, deploying application whitelisting or sandboxing solutions for applications utilizing libgphoto2 can limit the blast radius if a successful exploitation attempt occurs by preventing arbitrary code execution from gaining system-level privileges. Regular security audits focusing on memory safety in C/C++ libraries are essential to prevent similar out-of-bounds vulnerabilities in other components of the imaging stack.