CVE-2026-40338

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40338", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-10T22:50:01.358Z", "datePublished": "2026-04-17T23:40:10.097Z", "dateUpdated": "2026-04-20T16:16:08.585Z"}, "containers": {"cna": {"title": "libgphoto2 has OOB read in ptp_unpack_Sony_DPD() enumeration count parsing in ptp-pack.c", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "LOW", "baseScore": 5.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/gphoto/libgphoto2/security/advisories/GHSA-2hwp-w84q-27hf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gphoto/libgphoto2/security/advisories/GHSA-2hwp-w84q-27hf"}, {"name": "https://github.com/gphoto/libgphoto2/commit/3b9f9696be76ae51dca983d9dd8ce586a2561845", "tags": ["x_refsource_MISC"], "url": "https://github.com/gphoto/libgphoto2/commit/3b9f9696be76ae51dca983d9dd8ce586a2561845"}], "affected": [{"vendor": "gphoto", "product": "libgphoto2", "versions": [{"version": "<= 2.5.33", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-17T23:40:10.097Z"}, "descriptions": [{"lang": "en", "value": "libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in the PTP_DPFF_Enumeration case of `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (line 856). The function reads a 2-byte enumeration count N via `dtoh16o(data, *poffset)` without verifying that 2 bytes remain in the buffer. The standard `ptp_unpack_DPD()` at line 704 has this exact check, confirming the Sony variant omitted it by oversight. Commit 3b9f9696be76ae51dca983d9dd8ce586a2561845 fixes the issue."}], "source": {"advisory": "GHSA-2hwp-w84q-27hf", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-20T16:13:41.644804Z", "id": "CVE-2026-40338", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T16:16:08.585Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40338", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T16:13:41.644804Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T16:13:42.836Z"}}], "cna": {"title": "libgphoto2 has OOB read in ptp_unpack_Sony_DPD() enumeration count parsing in ptp-pack.c", "source": {"advisory": "GHSA-2hwp-w84q-27hf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.2, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "gphoto", "product": "libgphoto2", "versions": [{"status": "affected", "version": "<= 2.5.33"}]}], "references": [{"url": "https://github.com/gphoto/libgphoto2/security/advisories/GHSA-2hwp-w84q-27hf", "name": "https://github.com/gphoto/libgphoto2/security/advisories/GHSA-2hwp-w84q-27hf", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/gphoto/libgphoto2/commit/3b9f9696be76ae51dca983d9dd8ce586a2561845", "name": "https://github.com/gphoto/libgphoto2/commit/3b9f9696be76ae51dca983d9dd8ce586a2561845", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in the PTP_DPFF_Enumeration case of `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (line 856). The function reads a 2-byte enumeration count N via `dtoh16o(data, *poffset)` without verifying that 2 bytes remain in the buffer. The standard `ptp_unpack_DPD()` at line 704 has this exact check, confirming the Sony variant omitted it by oversight. Commit 3b9f9696be76ae51dca983d9dd8ce586a2561845 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-17T23:40:10.097Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40338", "state": "PUBLISHED", "dateUpdated": "2026-04-20T16:16:08.585Z", "dateReserved": "2026-04-10T22:50:01.358Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-17T23:40:10.097Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "libgphoto2", "vendor": "gphoto", "versions": [{"status": "affected", "version": "<= 2.5.33"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in the PTP_DPFF_Enumeration case of `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (line 856). The function reads a 2-byte enumeration count N via `dtoh16o(data, *poffset)` without verifying that 2 bytes remain in the buffer. The standard `ptp_unpack_DPD()` at line 704 has this exact check, confirming the Sony variant omitted it by oversight. Commit 3b9f9696be76ae51dca983d9dd8ce586a2561845 fixes the issue."}, {"lang": "es", "value": "libgphoto2 es una biblioteca de acceso y control de c\u00e1maras. Las versiones hasta la 2.5.33 inclusive tienen una lectura fuera de l\u00edmites en el caso PTP_DPFF_Enumeration de \u2019ptp_unpack_Sony_DPD()\u2019 en \u2019camlibs/ptp2/ptp-pack.c\u2019 (l\u00ednea 856). La funci\u00f3n lee un recuento de enumeraci\u00f3n N de 2 bytes a trav\u00e9s de \u2019dtoh16o(data, poffset)\u2019 sin verificar que queden 2 bytes en el b\u00fafer. La funci\u00f3n est\u00e1ndar \u2019ptp_unpack_DPD()\u2019 en la l\u00ednea 704 tiene esta verificaci\u00f3n exacta, lo que confirma que la variante de Sony lo omiti\u00f3 por descuido. El commit 3b9f9696be76ae51dca983d9dd8ce586a2561845 soluciona el problema."}], "id": "CVE-2026-40338", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "LOW", "baseScore": 5.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40338", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-20T16:13:41.644804Z", "version": "2.0.3"}}]}, "published": "2026-04-18T00:16:37.810", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/gphoto/libgphoto2/commit/3b9f9696be76ae51dca983d9dd8ce586a2561845"}, {"source": "security-advisories@github.com", "url": "https://github.com/gphoto/libgphoto2/security/advisories/GHSA-2hwp-w84q-27hf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "libgphoto2: libgphoto2: Information disclosure and denial of service via out-of-bounds read", "id": "2459368", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459368"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in the PTP_DPFF_Enumeration case of `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (line 856). The function reads a 2-byte enumeration count N via `dtoh16o(data, *poffset)` without verifying that 2 bytes remain in the buffer. The standard `ptp_unpack_DPD()` at line 704 has this exact check, confirming the Sony variant omitted it by oversight. Commit 3b9f9696be76ae51dca983d9dd8ce586a2561845 fixes the issue.", "A flaw was found in libgphoto2, a library for camera access and control. An out-of-bounds read vulnerability exists in the `ptp_unpack_Sony_DPD()` function. This occurs when the function attempts to read a 2-byte enumeration count without first verifying that sufficient data remains in the buffer. A local attacker or a malicious device connected to the system could exploit this to potentially disclose sensitive information from memory or cause a denial of service."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, restrict physical access to systems running libgphoto2 and avoid connecting untrusted or malicious devices. This operational control limits the attack surface by preventing the necessary physical interaction or device connection required for exploitation."}, "name": "CVE-2026-40338", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "libgphoto2", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Fix deferred", "package_name": "libgphoto2", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "libgphoto2", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "libgphoto2", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "libgphoto2", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-17T23:40:10Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-40338\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40338\nhttps://github.com/gphoto/libgphoto2/commit/3b9f9696be76ae51dca983d9dd8ce586a2561845\nhttps://github.com/gphoto/libgphoto2/security/advisories/GHSA-2hwp-w84q-27hf"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.5.33]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "libgphoto2", "vendor": "gphoto"}], "analysis": {"en": {"generated_at": "2026-04-18T08:46:23.314653+00:00", "value": {"mitigation_remediation": ["Upgrade libgphoto2 to the latest release or apply the patch commit 3b9f9696be76ae51dca983d9dd8ce586a2561845 to eliminate the unchecked buffer read.", "Ensure that all dependent software references the updated library and restart services to load the patched binary.", "If an immediate update is not feasible, restrict access to camera devices by limiting permissions to trusted users or disabling PTP features until the library can be updated."], "summary": {"action": "Patch Now", "impact": "Information disclosure via out-of-bounds read"}, "threat_synthesis": {"affected_systems": "Any installation of libgphoto2 for the gphoto vendor with a version 2.5.33 or earlier is affected. Software that depends on this library and communicates with Sony cameras via the PTP_DPFF_Enumeration content will also be vulnerable. Public releases newer than 2.5.33 contain the fix and are not impacted.", "description_and_impact": "The vulnerability stems from the libgphoto2 camera library, specifically the ptp_unpack_Sony_DPD() routine in ptp-pack.c. In versions up to 2.5.33 the function reads a 2\u2011byte enumeration count without first verifying that the buffer contains two bytes. This unchecked read can expose arbitrary memory contents from the host process that handles camera communication, constituting a classic out-of-bounds read flaw.", "risk_and_exploitability": "The CVSS score of 5.2 indicates a medium severity threat. Exploitation would require an attacker to supply crafted PTP commands to the library, typically by interacting with a connected camera device or through a vulnerable camera control application. Because the flaw is an out-of-bounds read rather than a format\u2011string or privilege\u2011escalation bug, the risk of arbitrary code execution is low, but the potential to leak sensitive data is present. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, suggesting a moderate but not imminent exploitation risk. The likely attack vector is a local or device-based attack where the attacker can send compromised data to the library."}}}}, "created": "2026-04-18T09:00:05.890435+00:00", "updated": "2026-04-20T14:59:09.511974+00:00", "vendors": ["gphoto", "gphoto$PRODUCT$libgphoto2"]}