CVE-2026-40341: falha de baixa gravidade em gphoto libgphoto2
libgphoto2 has an OOB Read in ptp_unpack_EOS_FocusInfoEx
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 3.5epss 0.2%
libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, an out of bound read in ptp_unpack_EOS_FocusInfoEx could be used to crash libgphoto2 when processing input from untrusted USB devices. Commit c385b34af260595dfbb5f9329526be5158985987 contains a patch. No known workarounds are available.
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Produtos afetados
gphoto · libgphoto2CVEs relacionadas — gphoto libgphoto2
No mesmo produto, das mais perigosas para as menos.
CVE-2026-40340MEDIUMlibgphoto2 has OOB read in ptp_unpack_OI() in ptp-pack.c via malicious PTP ObjectInfo responseEPSS 0.2%CVE-2026-40333MEDIUMlibgphoto2 has OOB read in ptp_unpack_EOS_ImageFormat() and ptp_unpack_EOS_CustomFuncEx() due to missing length parameter in ptp-pack.cEPSS 0.2%CVE-2026-40339MEDIUMlibgphoto2 has OOB read in ptp_unpack_Sony_DPD() FormFlag parsing in ptp-pack.cEPSS 0.2%CVE-2026-40338MEDIUMlibgphoto2 has OOB read in ptp_unpack_Sony_DPD() enumeration count parsing in ptp-pack.cEPSS 0.2%CVE-2026-40335MEDIUMlibgphoto2 has OOB read in ptp_unpack_DPV() UINT128/INT128 handling in ptp-pack.cEPSS 0.2%CVE-2026-40334LOWlibgphoto2 missing null termination in ptp_unpack_Canon_FE() filename buffer in ptp-pack.cEPSS 0.2%