libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, an out of bound read in ptp_unpack_EOS_FocusInfoEx could be used to crash libgphoto2 when processing input from untrusted USB devices. Commit c385b34af260595dfbb5f9329526be5158985987 contains a patch. No known workarounds are available.

Affected: openEuler:24.03-LTS: libgphoto2

is the core of gphoto2 software. It is a portable library which gives access to literally hundreds of digital cameras. Security Fix(es):

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in the ptp_unpack_Canon_FE() function in camlibs/ptp2/ptp-pack.c (line 1377). The function copies a filename into a 13-byte buffer using strncpy without explicitly null-terminating the result. If the source data is exactly 13 bytes with no null terminator, the buffer is left unterminated, leading to out-of-bounds reads in any subsequent string operation.(CVE-2026-40334)

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the `ptp_unpack_DPV()` function within `camlibs/ptp2/ptp-pack.c` (lines 622–629). When handling UINT128 and INT128 data types, the code advances the buffer offset by `*offset += 16` without verifying that 16 bytes remain in the buffer. The entry check at line 609 only ensures `*offset < total` (at least 1 byte available), leaving up to 15 bytes unvalidated. This could lead to reading beyond the buffer boundary, resulting in a crash or information disclosure. The issue has been patched in commit 433bde9888d70aa726e32744cd751d7dbe94379a.(CVE-2026-40335)

libgphoto2 is an open-source library for accessing and controlling cameras. Versions up to and including 2.5.33 contain an out-of-bounds read vulnerability in the `…

libgphoto2-6-2.5.34-1.1 on GA media

Affected: Ubuntu:14.04:LTS: libgphoto2, Ubuntu:16.04:LTS: libgphoto2, Ubuntu:18.04:LTS: libgphoto2, Ubuntu:20.04:LTS: libgphoto2, Ubuntu:22.04:LTS: libgphoto2, Ubuntu:24.04:LTS: libgphoto2, Ubuntu:25.10: libgphoto2, Ubuntu:26.04:LTS: libgphoto2

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, an out of bound read in ptp_unpack_EOS_FocusInfoEx could be used to crash libgphoto2 when processing input from untrusted USB devices. Commit c385b34af260595dfbb5f9329526be5158985987 contains a patch. No known workarounds are available.