gphoto libgphoto2 up to 2.5.33 camlibs/ptp2/ptp-pack.c ptp_unpack_EOS_events length out-of-bounds

Summaryinfo

A vulnerability was found in gphoto libgphoto2 up to 2.5.33. It has been rated as critical. The affected element is the function ptp_unpack_EOS_events of the file camlibs/ptp2/ptp-pack.c. Performing a manipulation of the argument length results in out-of-bounds. This vulnerability is known as CVE-2026-40333. The attack may be carried out on the physical device. No exploit is available. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability classified as critical has been found in gphoto libgphoto2 up to 2.5.33. This affects the function ptp_unpack_EOS_events of the file camlibs/ptp2/ptp-pack.c. The manipulation of the argument length with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, two functions in camlibs/ptp2/ptp-pack.c accept a data pointer but no length parameter, performing unbounded reads. Their callers in ptp_unpack_EOS_events() have xsize available but never pass it, leaving both functions unable to validate reads against the actual buffer boundary. Commit 1817ecead20c2aafa7549dac9619fe38f47b2f53 patches the issue.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-40333 since 04/11/2026. The exploitability is told to be easy. Attacking locally is a requirement. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 307447 (Linux Distros Unpatched Vulnerability : CVE-2026-40333), which helps to determine the existence of the flaw in a target environment.

Applying the patch 1817ecead20c2aafa7549dac9619fe38f47b2f53 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the databases at Tenable (307447) and EUVD (EUVD-2026-23581). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• gphoto

Name

• libgphoto2

Version

• 2.5.0
• 2.5.1
• 2.5.2
• 2.5.3
• 2.5.4
• 2.5.5
• 2.5.6
• 2.5.7
• 2.5.8
• 2.5.9
• 2.5.10
• 2.5.11
• 2.5.12
• 2.5.13
• 2.5.14
• 2.5.15
• 2.5.16
• 2.5.17
• 2.5.18
• 2.5.19
• 2.5.20
• 2.5.21
• 2.5.22
• 2.5.23
• 2.5.24
• 2.5.25
• 2.5.26
• 2.5.27
• 2.5.28
• 2.5.29
• 2.5.30
• 2.5.31
• 2.5.32
• 2.5.33

License

• open-source

Website

• Product: https://github.com/gphoto/libgphoto2/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion