TI-2026-29115 Aliases CVE-2026-40340

libgphoto2 has OOB read in ptp_unpack_OI() in ptp-pack.c via malicious PTP ObjectInfo response

LOW 27CWE-125Published 2026-04-17 · Updated 2026-04-20

Key facts

Attack vector: Physical
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · High
Fix status: Deferred Red Hat: fix deferred

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read vulnerability in `ptp_unpack_OI()` in `camlibs/ptp2/ptp-pack.c` (lines 530–563). The function validates `len < PTP_oi_SequenceNumber` (i.e., len < 48) but subsequently accesses offsets 48–56, up to 9 bytes beyond the validated boundary, via the Samsung Galaxy 64-bit objectsize detection heuristic. Commit 7c7f515bc88c3d0c4098ac965d313518e0ccbe33 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00218 12th percentileScored 2026-11-07

Fix Deferred Red Hat: fix deferred

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
gphoto	libgphoto2	up to 2.5.33	—	No fix listed	CNA

libgphoto2 Vendorgphoto Affected up to 2.5.33 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-40340

References

Other 2

TI-2026-83843 Buffer overflow in libgphoto2 jl2005c camera driver CVSS 4.0HIGH 7.0
TI-2026-29108 Out-of-bounds read in gphoto libgphoto2 CVSS 3.1MEDIUM 6.1
TI-2026-83844 libgphoto2 Heap Out-of-Bounds Read/Write via jl2005c Thumbnail Conversion CVSS 4.0MEDIUM 5.2
TI-2026-29114 libgphoto2 has OOB read in ptp_unpack_Sony_DPD() FormFlag parsing in ptp-pack.c CVSS 3.1MEDIUM 5.2
TI-2026-29113 libgphoto2 has OOB read in ptp_unpack_Sony_DPD() enumeration count parsing in ptp-pack.c CVSS 3.1MEDIUM 5.2
TI-2026-29110 libgphoto2 has OOB read in ptp_unpack_DPV() UINT128/INT128 handling in ptp-pack.c CVSS 3.1MEDIUM 5.2

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences