CVE-2026-40338
libgphoto2 is a camera access and control library.
Published Apr 18, 2026 · updated Jun 17, 2026
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in the PTP_DPFF_Enumeration case of in (line 856). The function reads a 2-byte enumeration count N via without verifying that 2 bytes remain in the buffer. The standard at line 704 has this exact check, confirming the Sony variant omitted it by oversight. Commit 3b9f9696be76ae51dca983d9dd8ce586a2561845 fixes the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 18, 2026 · NIST NVD
Detected
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in the PTP_DPFF_Enumeration case of in (line 856). The function reads a 2-byte enumeration count N via without verifying that 2 bytes remain in the buffer. The standard at line 704 has this exact check, confirming the Sony variant omitted it by oversight. Commit 3b9f9696be76ae51dca983d
Jun 17, 2026 · NIST NVD
Updated
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in the PTP_DPFF_Enumeration case of in (line 856). The function reads a 2-byte enumeration count N via without verifying that 2 bytes remain in the buffer. The standard at line 704 has this exact check, confirming the Sony variant omitted it by oversight. Commit 3b9f9696be76ae51dca983d
Sources
- CVE.orgVulnerability recordCVE-2026-40338
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-40338
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read in the PTP_DPFF_Enumeration case of in (line 856). The function reads a 2-byte enumeration count N via `dtoh16o(data
nvd.nist.gov