CVE-2026-40335: falha de média gravidade em gphoto libgphoto2
libgphoto2 has OOB read in ptp_unpack_DPV() UINT128/INT128 handling in ptp-pack.c
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.2epss 0.2%
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in `ptp_unpack_DPV()` in `camlibs/ptp2/ptp-pack.c` (lines 622–629). The UINT128 and INT128 cases advance `*offset += 16` without verifying that 16 bytes remain in the buffer. The entry check at line 609 only guarantees `*offset < total` (at least 1 byte available), leaving up to 15 bytes unvalidated. Commit 433bde9888d70aa726e32744cd751d7dbe94379a patches the issue.
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Produtos afetados
gphoto · libgphoto2CVEs relacionadas — gphoto libgphoto2
No mesmo produto, das mais perigosas para as menos.
CVE-2026-40340MEDIUMlibgphoto2 has OOB read in ptp_unpack_OI() in ptp-pack.c via malicious PTP ObjectInfo responseEPSS 0.2%CVE-2026-40333MEDIUMlibgphoto2 has OOB read in ptp_unpack_EOS_ImageFormat() and ptp_unpack_EOS_CustomFuncEx() due to missing length parameter in ptp-pack.cEPSS 0.2%CVE-2026-40339MEDIUMlibgphoto2 has OOB read in ptp_unpack_Sony_DPD() FormFlag parsing in ptp-pack.cEPSS 0.2%CVE-2026-40338MEDIUMlibgphoto2 has OOB read in ptp_unpack_Sony_DPD() enumeration count parsing in ptp-pack.cEPSS 0.2%CVE-2026-40341LOWlibgphoto2 has an OOB Read in ptp_unpack_EOS_FocusInfoExEPSS 0.2%CVE-2026-40334LOWlibgphoto2 missing null termination in ptp_unpack_Canon_FE() filename buffer in ptp-pack.cEPSS 0.2%