TI-2026-83844 Aliases CVE-2026-120452 GHSA-4cvw-qwj9-xjc2

libgphoto2 Heap Out-of-Bounds Read/Write via jl2005c Thumbnail Conversion

LOW 23CWE-787Published 2026-11-02 · Updated 2026-11-02

Key facts

Attack vector: Physical
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: Low · Low · High
Fix status: Deferred Red Hat: fix deferred

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write in jl2005bcd_decompress() (CWE-787). A malicious USB camera can corrupt heap memory through oversized thumbnail processing. Attackers supply small allocation-table values and a thumbnail header byte, so in-place byte-swapping exceeds the buffer by about 30 KB and leaks heap contents in preview images.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd_decompress() that allows malicious USB cameras to corrupt heap memory via oversized thumbnail processing. Attackers can supply small allocation-table values and a thumbnail header byte so in-place byte-swapping exceeds the buffer by about 30 KB, leaking heap contents in preview images.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00185 8th percentileScored 2026-11-07

Fix Deferred Red Hat: fix deferred

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
gphoto	libgphoto2	up to 2.5.34	—	No fix listed	CNA

libgphoto2 Vendorgphoto Affected up to 2.5.34 Fixed in — No fix listed CNA

Remediation

No fixed version is listed for libgphoto2. Red Hat has no fix planned for Enterprise Linux 6 and 7, and none is available for Enterprise Linux 8, 9 and 10. Until a fix is released, avoid connecting untrusted USB cameras to affected systems.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred

Timeline

2026-11-02 Threatist record created from CVE-2026-120452
2026-11-02 Alias added: GHSA-4cvw-qwj9-xjc2
2026-11-02 CISA SSVC decision points changed
2026-11-03 Affected versions changed · Red Hat
2026-11-03 CVSS score added · Red Hat

References

Patch 2

Other 3

TI-2026-83843 Buffer overflow in libgphoto2 jl2005c camera driver CVSS 4.0HIGH 7.0
TI-2026-29115 libgphoto2 has OOB read in ptp_unpack_OI() in ptp-pack.c via malicious PTP ObjectInfo response CVSS 3.1MEDIUM 6.1
TI-2026-29108 Out-of-bounds read in gphoto libgphoto2 CVSS 3.1MEDIUM 6.1
TI-2026-29114 libgphoto2 has OOB read in ptp_unpack_Sony_DPD() FormFlag parsing in ptp-pack.c CVSS 3.1MEDIUM 5.2
TI-2026-29113 libgphoto2 has OOB read in ptp_unpack_Sony_DPD() enumeration count parsing in ptp-pack.c CVSS 3.1MEDIUM 5.2
TI-2026-29110 libgphoto2 has OOB read in ptp_unpack_DPV() UINT128/INT128 handling in ptp-pack.c CVSS 3.1MEDIUM 5.2

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences