CVE-2026-120451

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-120451", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-02T12:42:20.273Z", "datePublished": "2026-11-02T14:29:09.529Z", "dateUpdated": "2026-11-06T19:33:49.177Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-02T14:29:09.529Z"}, "datePublic": "2026-10-22T00:00:00.000Z", "title": "libgphoto2 through 2.5.34 Buffer Overflow via jl2005c Camera Driver", "descriptions": [{"lang": "en", "value": "libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005c_init() that allow malicious USB devices to corrupt memory by supplying an unbounded allocation table entry count. Attackers can connect a spoofed Jeilin JL2005B/C/D camera reporting 1022 or more entries to overwrite the saved return address and heap data, potentially achieving code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Out-of-bounds Write", "cweId": "CWE-787", "type": "CWE"}]}], "affected": [{"vendor": "gPhoto", "product": "libgphoto2", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "2.5.34", "status": "affected", "versionType": "semver"}], "repo": "https://github.com/gphoto/libgphoto2"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "PHYSICAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector": "PHYSICAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/gphoto/libgphoto2/issues/1326", "tags": ["issue-tracking"]}, {"url": "https://github.com/gphoto/libgphoto2/commit/af3b8e9c542cda863fb5f2f3cfeb261bd78e4442", "tags": ["patch"]}, {"url": "https://github.com/gphoto/libgphoto2/commit/6a3393dd996502457ab965432cf0b2035278825e", "tags": ["patch"]}, {"url": "https://github.com/gphoto/libgphoto2/blob/v2.5.34/camlibs/jl2005c/jl2005c.c#L138-L154", "tags": ["technical-description"]}, {"url": "https://hackmd.io/@haindpwn/libgphoto2-jl2005c-init-alloc-table-buffer-overflow", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: libgphoto2 through 2.5.34 Buffer Overflow via jl2005c Camera Driver", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/libgphoto2-through-2.5.34-buffer-overflow-via-jl2005c-camera-driver"}], "credits": [{"lang": "en", "value": "HaiND from the Post and Telecommunication Institute of Technology", "type": "finder"}, {"lang": "en", "value": "TheProtagonist07", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://hackmd.io/@haindpwn/libgphoto2-jl2005c-init-alloc-table-buffer-overflow", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-06T19:33:10.344301Z", "id": "CVE-2026-120451", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T19:33:49.177Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-120451", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-06T19:33:10.344301Z"}}}], "references": [{"url": "https://hackmd.io/@haindpwn/libgphoto2-jl2005c-init-alloc-table-buffer-overflow", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T19:33:23.421Z"}}], "cna": {"title": "libgphoto2 through 2.5.34 Buffer Overflow via jl2005c Camera Driver", "credits": [{"lang": "en", "type": "finder", "value": "HaiND from the Post and Telecommunication Institute of Technology"}, {"lang": "en", "type": "remediation developer", "value": "TheProtagonist07"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 7, "attackVector": "PHYSICAL", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"repo": "https://github.com/gphoto/libgphoto2", "vendor": "gPhoto", "product": "libgphoto2", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.5.34"}], "defaultStatus": "unaffected"}], "datePublic": "2026-10-22T00:00:00.000Z", "references": [{"url": "https://github.com/gphoto/libgphoto2/issues/1326", "tags": ["issue-tracking"]}, {"url": "https://github.com/gphoto/libgphoto2/commit/af3b8e9c542cda863fb5f2f3cfeb261bd78e4442", "tags": ["patch"]}, {"url": "https://github.com/gphoto/libgphoto2/commit/6a3393dd996502457ab965432cf0b2035278825e", "tags": ["patch"]}, {"url": "https://github.com/gphoto/libgphoto2/blob/v2.5.34/camlibs/jl2005c/jl2005c.c#L138-L154", "tags": ["technical-description"]}, {"url": "https://hackmd.io/@haindpwn/libgphoto2-jl2005c-init-alloc-table-buffer-overflow", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/libgphoto2-through-2.5.34-buffer-overflow-via-jl2005c-camera-driver", "name": "VulnCheck Advisory: libgphoto2 through 2.5.34 Buffer Overflow via jl2005c Camera Driver", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005c_init() that allow malicious USB devices to corrupt memory by supplying an unbounded allocation table entry count. Attackers can connect a spoofed Jeilin JL2005B/C/D camera reporting 1022 or more entries to overwrite the saved return address and heap data, potentially achieving code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-02T14:29:09.529Z"}}}, "cveMetadata": {"cveId": "CVE-2026-120451", "state": "PUBLISHED", "dateUpdated": "2026-11-06T19:33:49.177Z", "dateReserved": "2026-11-02T12:42:20.273Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-11-02T14:29:09.529Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "libgphoto2", "repo": "https://github.com/gphoto/libgphoto2", "vendor": "gPhoto", "versions": [{"lessThanOrEqual": "2.5.34", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005c_init() that allow malicious USB devices to corrupt memory by supplying an unbounded allocation table entry count. Attackers can connect a spoofed Jeilin JL2005B/C/D camera reporting 1022 or more entries to overwrite the saved return address and heap data, potentially achieving code execution."}], "id": "CVE-2026-120451", "lastModified": "2026-11-06T20:17:17.567", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "PHYSICAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-120451", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T19:33:10.344301Z", "version": "2.0.3"}}]}, "published": "2026-11-02T15:17:28.357", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/gphoto/libgphoto2/blob/v2.5.34/camlibs/jl2005c/jl2005c.c#L138-L154"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/gphoto/libgphoto2/commit/6a3393dd996502457ab965432cf0b2035278825e"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/gphoto/libgphoto2/commit/af3b8e9c542cda863fb5f2f3cfeb261bd78e4442"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/gphoto/libgphoto2/issues/1326"}, {"source": "disclosure@vulncheck.com", "url": "https://hackmd.io/@haindpwn/libgphoto2-jl2005c-init-alloc-table-buffer-overflow"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/libgphoto2-through-2.5.34-buffer-overflow-via-jl2005c-camera-driver"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://hackmd.io/@haindpwn/libgphoto2-jl2005c-init-alloc-table-buffer-overflow"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "libgphoto2: libgphoto2: arbitrary code execution via buffer overflow in jl2005c camera driver", "id": "2568478", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2568478"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005c_init() that allow malicious USB devices to corrupt memory by supplying an unbounded allocation table entry count. Attackers can connect a spoofed Jeilin JL2005B/C/D camera reporting 1022 or more entries to overwrite the saved return address and heap data, potentially achieving code execution.", "A flaw was found in libgphoto2. An attacker can execute arbitrary code or cause a denial of service (DoS) by connecting a malicious USB device to the system. This vulnerability occurs because the jl2005c camera driver fails to validate the allocation table entry count during device initialization, leading to stack- and heap-based buffer overflows."], "mitigation": {"lang": "en:us", "value": "To mitigate this vulnerability on systems where digital camera support is not needed, remove the libgphoto2 package:\n# dnf remove libgphoto2\nCaveat: Removing libgphoto2 may remove dependent packages such as gvfs-gphoto2, sane-backends, or graphical desktop components (such as GNOME packages). Verify the transaction list prior to confirming removal. Headless servers remain fully operational via terminal sessions even if graphical desktop packages are uninstalled.\nAlternatively, on systems where camera libraries must be retained, prevent unauthorized physical peripherals by enforcing a USB device authorization policy using USBGuard:\n# systemctl enable --now usbguard\nCaveat: Starting the USBGuard daemon blocks newly inserted and unapproved USB devices until an administrator explicitly authorizes them. Ensure that required system peripherals are allowed in the policy prior to enforcement to prevent accidental lockout of input devices."}, "name": "CVE-2026-120451", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "libgphoto2", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Out of support scope", "package_name": "libgphoto2", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Fix deferred", "package_name": "libgphoto2", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "libgphoto2", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "libgphoto2", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-11-02T14:29:09Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-120451\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-120451\nhttps://github.com/gphoto/libgphoto2/blob/v2.5.34/camlibs/jl2005c/jl2005c.c#L138-L154\nhttps://github.com/gphoto/libgphoto2/commit/6a3393dd996502457ab965432cf0b2035278825e\nhttps://github.com/gphoto/libgphoto2/commit/af3b8e9c542cda863fb5f2f3cfeb261bd78e4442\nhttps://github.com/gphoto/libgphoto2/issues/1326\nhttps://hackmd.io/@haindpwn/libgphoto2-jl2005c-init-alloc-table-buffer-overflow\nhttps://www.vulncheck.com/advisories/libgphoto2-through-2.5.34-buffer-overflow-via-jl2005c-camera-driver"], "statement": "This vulnerability is rated as Moderate severity rather than Important because successful exploitation strictly requires physical access or the ability to attach a malicious USB device to the host. In typical Red Hat Enterprise Linux server installations, digital camera libraries like libgphoto2 are not actively utilized or are absent unless graphical desktop packages or digital imaging suites are installed. While connecting a crafted USB peripheral spoofing a Jeilin camera can trigger memory corruption during driver initialization, the physical access prerequisite and lack of automated remote exposure significantly limit the operational risk in enterprise environments.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.5.34]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "libgphoto2", "source": "cna", "vendor": "gPhoto"}, "product": "libgphoto2", "vendor": "gphoto"}], "created": "2026-11-02T15:30:14.814713+00:00", "updated": "2026-11-02T16:00:09.819528+00:00", "vendors": ["gphoto", "gphoto$PRODUCT$libgphoto2"]}