CVE-2026-40335

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40335", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-10T22:50:01.357Z", "datePublished": "2026-04-17T23:19:16.935Z", "dateUpdated": "2026-04-20T13:36:05.542Z"}, "containers": {"cna": {"title": "libgphoto2 has OOB read in ptp_unpack_DPV() UINT128/INT128 handling in ptp-pack.c", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "LOW", "baseScore": 5.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/gphoto/libgphoto2/security/advisories/GHSA-g4g5-c2x9-cqfj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gphoto/libgphoto2/security/advisories/GHSA-g4g5-c2x9-cqfj"}, {"name": "https://github.com/gphoto/libgphoto2/commit/433bde9888d70aa726e32744cd751d7dbe94379a", "tags": ["x_refsource_MISC"], "url": "https://github.com/gphoto/libgphoto2/commit/433bde9888d70aa726e32744cd751d7dbe94379a"}], "affected": [{"vendor": "gphoto", "product": "libgphoto2", "versions": [{"version": "<= 2.5.33", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-17T23:19:16.935Z"}, "descriptions": [{"lang": "en", "value": "libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in `ptp_unpack_DPV()` in `camlibs/ptp2/ptp-pack.c` (lines 622\u2013629). The UINT128 and INT128 cases advance `*offset += 16` without verifying that 16 bytes remain in the buffer. The entry check at line 609 only guarantees `*offset < total` (at least 1 byte available), leaving up to 15 bytes unvalidated. Commit 433bde9888d70aa726e32744cd751d7dbe94379a patches the issue."}], "source": {"advisory": "GHSA-g4g5-c2x9-cqfj", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40335", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T13:28:20.070883Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T13:36:05.542Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40335", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T13:28:20.070883Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T13:32:31.035Z"}}], "cna": {"title": "libgphoto2 has OOB read in ptp_unpack_DPV() UINT128/INT128 handling in ptp-pack.c", "source": {"advisory": "GHSA-g4g5-c2x9-cqfj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.2, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "gphoto", "product": "libgphoto2", "versions": [{"status": "affected", "version": "<= 2.5.33"}]}], "references": [{"url": "https://github.com/gphoto/libgphoto2/security/advisories/GHSA-g4g5-c2x9-cqfj", "name": "https://github.com/gphoto/libgphoto2/security/advisories/GHSA-g4g5-c2x9-cqfj", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/gphoto/libgphoto2/commit/433bde9888d70aa726e32744cd751d7dbe94379a", "name": "https://github.com/gphoto/libgphoto2/commit/433bde9888d70aa726e32744cd751d7dbe94379a", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in `ptp_unpack_DPV()` in `camlibs/ptp2/ptp-pack.c` (lines 622\u2013629). The UINT128 and INT128 cases advance `*offset += 16` without verifying that 16 bytes remain in the buffer. The entry check at line 609 only guarantees `*offset < total` (at least 1 byte available), leaving up to 15 bytes unvalidated. Commit 433bde9888d70aa726e32744cd751d7dbe94379a patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-17T23:19:16.935Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40335", "state": "PUBLISHED", "dateUpdated": "2026-04-20T13:36:05.542Z", "dateReserved": "2026-04-10T22:50:01.357Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-17T23:19:16.935Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "libgphoto2", "vendor": "gphoto", "versions": [{"status": "affected", "version": "<= 2.5.33"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in `ptp_unpack_DPV()` in `camlibs/ptp2/ptp-pack.c` (lines 622\u2013629). The UINT128 and INT128 cases advance `*offset += 16` without verifying that 16 bytes remain in the buffer. The entry check at line 609 only guarantees `*offset < total` (at least 1 byte available), leaving up to 15 bytes unvalidated. Commit 433bde9888d70aa726e32744cd751d7dbe94379a patches the issue."}, {"lang": "es", "value": "libgphoto2 es una biblioteca de acceso y control de c\u00e1maras. Las versiones hasta la 2.5.33 inclusive tienen una lectura fuera de l\u00edmites en \u2019ptp_unpack_DPV()\u2019 en \u2019camlibs/ptp2/ptp-pack.c\u2019 (l\u00edneas 622-629). Los casos UINT128 e INT128 avanzan \u2019offset += 16\u2019 sin verificar que queden 16 bytes en el b\u00fafer. La verificaci\u00f3n de entrada en la l\u00ednea 609 solo garantiza \u2019offset < total\u2019 (al menos 1 byte disponible), dejando hasta 15 bytes sin validar. El commit 433bde9888d70aa726e32744cd751d7dbe94379a corrige el problema."}], "id": "CVE-2026-40335", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "LOW", "baseScore": 5.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40335", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-20T13:28:20.070883Z", "version": "2.0.3"}}]}, "published": "2026-04-18T00:16:37.390", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/gphoto/libgphoto2/commit/433bde9888d70aa726e32744cd751d7dbe94379a"}, {"source": "security-advisories@github.com", "url": "https://github.com/gphoto/libgphoto2/security/advisories/GHSA-g4g5-c2x9-cqfj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "libgphoto2: libgphoto2: Information disclosure via out-of-bounds read in ptp_unpack_DPV()", "id": "2459354", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459354"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.2", "cvss3_scoring_vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L", "status": "draft"}, "cwe": "CWE-125", "details": ["libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in `ptp_unpack_DPV()` in `camlibs/ptp2/ptp-pack.c` (lines 622\u2013629). The UINT128 and INT128 cases advance `*offset += 16` without verifying that 16 bytes remain in the buffer. The entry check at line 609 only guarantees `*offset < total` (at least 1 byte available), leaving up to 15 bytes unvalidated. Commit 433bde9888d70aa726e32744cd751d7dbe94379a patches the issue.", "A flaw was found in libgphoto2, a library for camera access. This out-of-bounds read vulnerability in the `ptp_unpack_DPV()` function occurs because the software does not properly validate buffer boundaries when handling specific data types. An attacker with physical access to the device could exploit this to potentially disclose sensitive information or cause a denial of service."], "name": "CVE-2026-40335", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "libgphoto2", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "libgphoto2", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "libgphoto2", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "libgphoto2", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "libgphoto2", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-17T23:19:16Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-40335\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40335\nhttps://github.com/gphoto/libgphoto2/commit/433bde9888d70aa726e32744cd751d7dbe94379a\nhttps://github.com/gphoto/libgphoto2/security/advisories/GHSA-g4g5-c2x9-cqfj"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.5.33]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "libgphoto2", "vendor": "gphoto"}], "analysis": {"en": {"generated_at": "2026-04-18T08:48:31.588122+00:00", "value": {"mitigation_remediation": ["Upgrade libgphoto2 to a version that includes the patch (committed in 433bde9888d70aa726e32744cd751d7dbe94379a).", "If an upgrade is not possible, restrict or sandbox usage of libgphoto2 so that only trusted cameras can supply data, preventing untrusted data from reaching the vulnerable code path.", "Apply additional bounds checking in any custom code that interacts with libgphoto2 to ensure that reading 16 bytes will not exceed the buffer\u2019s length."], "summary": {"action": "Patch", "impact": "Information disclosure via out\u2011of\u2011bounds read"}, "threat_synthesis": {"affected_systems": "The flaw affects gphoto:libgphoto2 versions up to and including 2.5.33. Any application that processes data from cameras or PTP-compatible devices using this library is potentially impacted. No other product or version information is available in the advisory.", "description_and_impact": "An out\u2011of\u2011bounds read exists in libgphoto2\u2019s ptp_unpack_DPV() function when handling UINT128 and INT128 values. The function advances the read offset by 16 bytes without confirming that the buffer contains that many bytes, potentially exposing up to 15 bytes of adjacent memory. This vulnerability could allow an attacker to read sensitive data from the process\u2019s address space, but it does not provide any form of code execution or privilege escalation.", "risk_and_exploitability": "The CVSS score of 5.2 indicates a moderate impact, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalogue. The likely attack vector requires an attacker to supply crafted data to a camera or PTP device that the library parses, which is typically a trusted device. Successful exploitation would result in information disclosure, not remote code execution."}}}}, "created": "2026-04-18T09:00:05.892231+00:00", "updated": "2026-04-20T14:59:15.447883+00:00", "vendors": ["gphoto", "gphoto$PRODUCT$libgphoto2"]}