CVE-2026-120451

libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd_decompress(). Malicious USB cameras can supply small allocation-table values and a thumbnail header byte so in-place byte-swapping exceeds the buffer by about 30 KB, leaking heap contents in preview images.

libgphoto2 up to and including 2.5.33 has an out-of-bounds read in ptp_unpack_EOS_FocusInfoEx that could crash the library when processing input from untrusted USB devices. Commit c385b34af260595dfbb5f9329526be5158985987 contains a patch.

libgphoto2 versions up to and including 2.5.33 have an out-of-bounds read vulnerability in ptp_unpack_OI() in camlibs/ptp2/ptp-pack.c (lines 530–563). The function validates len < PTP_oi_SequenceNumber (i.e., len < 48) but subsequently accesses offsets 48–56, up to 9 bytes beyond the validated boundary, via the Samsung Galaxy 64-bit objectsize detection heuristic. Commit 7c7f515bc88c3d0c4098ac965d313518e0ccbe33 fixes the issue.

libgphoto2 versions up to and including 2.5.33 have an out-of-bounds read in ptp_unpack_Sony_DPD() in camlibs/ptp2/ptp-pack.c. The function reads the FormFlag byte without a prior bounds check, unlike the standard ptp_unpack_DPD() which performs this validation.

libgphoto2 up to and including 2.5.33 has an out-of-bounds read in the PTP_DPFF_Enumeration case of ptp_unpack_Sony_DPD() in camlibs/ptp2/ptp-pack.c (line 856). The function reads a 2-byte enumeration count N via dtoh16o(data, *poffset) without verifying that 2 bytes remain in the buffer. The standard ptp_unpack_DPD() at line 704 has this check, confirming the Sony variant omitted it by oversight. Commit 3b9f9696be76ae51dca983d9dd8ce586a2561845 fixes the issue.

libgphoto2 versions up to and including 2.5.33 have a memory leak in ptp_unpack_Sony_DPD() in camlibs/ptp2/ptp-pack.c. When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd->FORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation, leaking the array and its strings on every property descriptor parse.

libgphoto2 versions up to and including 2.5.33 have an out-of-bounds read in ptp_unpack_DPV() in camlibs/ptp2/ptp-pack.c. The UINT128 and INT128 cases advance the offset by 16 bytes without verifying that 16 bytes remain in the buffer.

libgphoto2 up to and including 2.5.33 has a missing null terminator in ptp_unpack_Canon_FE() in camlibs/ptp2/ptp-pack.c (line 1377). The function copies a filename into a 13-byte buffer using strncpy without explicitly null-terminating it; if the source is exactly 13 bytes with no null terminator, the buffer is left unterminated, leading to out-of-bounds reads in subsequent string operations. Commit 259fc7d3bfe534ce4b114c464f55b448670ab873 patches the issue.

libgphoto2 versions up to and including 2.5.33 have two functions in camlibs/ptp2/ptp-pack.c that accept a data pointer but no length parameter, performing unbounded reads. Their callers in ptp_unpack_EOS_events() have xsize available but never pass it, leaving both functions unable to validate reads against the actual buffer boundary. Commit 1817ecead20c2aafa7549dac9619fe38f47b2f53 patches the issue.