Read the docs
TI-2026-83843 Aliases CVE-2026-120451GHSA-7rfg-j54g-6xm2

Buffer overflow in libgphoto2 jl2005c camera driver

Priority HIGH 66CWE-787Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

libgphoto2 versions through 2.5.34 are affected. An out-of-bounds write (CWE-787) in the jl2005c_init() function causes stack and heap buffer overflows because the allocation table entry count is not bounded. An attacker who connects a spoofed Jeilin JL2005B/C/D camera over USB can corrupt memory and potentially execute code. The SSVC exploitation status is proof of concept.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005c_init() that allow malicious USB devices to corrupt memory by supplying an unbounded allocation table entry count. Attackers can connect a spoofed Jeilin JL2005B/C/D camera reporting 1022 or more entries to overwrite the saved return address and heap data, potentially achieving code execution.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00225 13th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gphotolibgphoto2up to 2.5.34—No fix listedCNA
  • libgphoto2 Vendorgphoto Affected up to 2.5.34 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for libgphoto2.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-11-02 Threatist record created from CVE-2026-120451
  2. 2026-11-02 Alias added: GHSA-7rfg-j54g-6xm2
  3. 2026-11-04 Priority changed: MEDIUM → LOW
  4. 2026-11-06 CISA SSVC decision points changed
  5. 2026-11-06 Priority changed: LOW → HIGH

References

Patch 2

Other 3

  • TI-2026-29115 libgphoto2 has OOB read in ptp_unpack_OI() in ptp-pack.c via malicious PTP ObjectInfo response CVSS 3.1MEDIUM 6.1
  • TI-2026-29108 Out-of-bounds read in gphoto libgphoto2 CVSS 3.1MEDIUM 6.1
  • TI-2026-83844 libgphoto2 Heap Out-of-Bounds Read/Write via jl2005c Thumbnail Conversion CVSS 4.0MEDIUM 5.2
  • TI-2026-29114 libgphoto2 has OOB read in ptp_unpack_Sony_DPD() FormFlag parsing in ptp-pack.c CVSS 3.1MEDIUM 5.2
  • TI-2026-29113 libgphoto2 has OOB read in ptp_unpack_Sony_DPD() enumeration count parsing in ptp-pack.c CVSS 3.1MEDIUM 5.2
  • TI-2026-29110 libgphoto2 has OOB read in ptp_unpack_DPV() UINT128/INT128 handling in ptp-pack.c CVSS 3.1MEDIUM 5.2
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences