gphoto libgphoto2 up to 2.5.33 camlibs/ptp2/ptp-pack.c ptp_unpack_Sony_DPD out-of-bounds

Summaryinfo

A vulnerability was found in gphoto libgphoto2 up to 2.5.33. It has been classified as critical. This issue affects the function ptp_unpack_Sony_DPD of the file camlibs/ptp2/ptp-pack.c. This manipulation causes out-of-bounds. This vulnerability appears as CVE-2026-40339. It is feasible to perform the attack on the physical device. There is no available exploit. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in gphoto libgphoto2 up to 2.5.33. It has been declared as critical. Affected by this vulnerability is the function ptp_unpack_Sony_DPD of the file camlibs/ptp2/ptp-pack.c. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (line 842). The function reads the FormFlag byte via `dtoh8o(data, *poffset)` without a prior bounds check. The standard `ptp_unpack_DPD()` at lines 686–687 correctly validates `*offset + sizeof(uint8_t) > dpdlen` before this same read, but the Sony variant omits this check entirely. Commit 09f8a940b1e418b5693f5c11e3016a1ad2cea62d fixes the issue.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-40339 since 04/11/2026. The exploitation appears to be easy. An attack has to be approached locally. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available.

Applying the patch 09f8a940b1e418b5693f5c11e3016a1ad2cea62d is able to eliminate this problem. The bugfix is ready for download at github.com.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• gphoto

Name

• libgphoto2

Version

• 2.5.0
• 2.5.1
• 2.5.2
• 2.5.3
• 2.5.4
• 2.5.5
• 2.5.6
• 2.5.7
• 2.5.8
• 2.5.9
• 2.5.10
• 2.5.11
• 2.5.12
• 2.5.13
• 2.5.14
• 2.5.15
• 2.5.16
• 2.5.17
• 2.5.18
• 2.5.19
• 2.5.20
• 2.5.21
• 2.5.22
• 2.5.23
• 2.5.24
• 2.5.25
• 2.5.26
• 2.5.27
• 2.5.28
• 2.5.29
• 2.5.30
• 2.5.31
• 2.5.32
• 2.5.33

License

• open-source

Website

• Product: https://github.com/gphoto/libgphoto2/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion