Read the docs
TI-2026-29109 Aliases CVE-2026-40334

libgphoto2 missing null termination in ptp_unpack_Canon_FE() filename buffer in ptp-pack.c

Priority LOW 16CWE-170Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · Low
Fix status
Deferred Red Hat: fix deferred

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in ptp_unpack_Canon_FE() in camlibs/ptp2/ptp-pack.c (line 1377). The function copies a filename into a 13-byte buffer using strncpy without explicitly null-terminating the result. If the source data is exactly 13 bytes with no null terminator, the buffer is left unterminated, leading to out-of-bounds reads in any subsequent string operation. Commit 259fc7d3bfe534ce4b114c464f55b448670ab873 patches the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00187 8th percentileScored 2026-11-07
Fix Deferred Red Hat: fix deferred

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gphotolibgphoto2up to 2.5.33—No fix listedCNA
  • libgphoto2 Vendorgphoto Affected up to 2.5.33 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 6AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40334

References

Other 2

  • TI-2026-83843 Buffer overflow in libgphoto2 jl2005c camera driver CVSS 4.0HIGH 7.0
  • TI-2026-29115 libgphoto2 has OOB read in ptp_unpack_OI() in ptp-pack.c via malicious PTP ObjectInfo response CVSS 3.1MEDIUM 6.1
  • TI-2026-29108 Out-of-bounds read in gphoto libgphoto2 CVSS 3.1MEDIUM 6.1
  • TI-2026-83844 libgphoto2 Heap Out-of-Bounds Read/Write via jl2005c Thumbnail Conversion CVSS 4.0MEDIUM 5.2
  • TI-2026-29114 libgphoto2 has OOB read in ptp_unpack_Sony_DPD() FormFlag parsing in ptp-pack.c CVSS 3.1MEDIUM 5.2
  • TI-2026-29113 libgphoto2 has OOB read in ptp_unpack_Sony_DPD() enumeration count parsing in ptp-pack.c CVSS 3.1MEDIUM 5.2
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences