CVE-2026-40333: libgphoto2 Buffer Overflow Vulnerability

CVE-2026-40333 Overview

CVE-2026-40333 is an out-of-bounds read vulnerability affecting libgphoto2, a widely-used camera access and control library. In versions up to and including 2.5.33, two functions in camlibs/ptp2/ptp-pack.c accept a data pointer but no length parameter, performing unbounded reads. The callers in ptp_unpack_EOS_events() have xsize available but never pass it, leaving both functions unable to validate reads against the actual buffer boundary.

Critical Impact

An attacker with physical access to a system running vulnerable versions of libgphoto2 could exploit this out-of-bounds read to disclose sensitive information from memory or cause application crashes, potentially leading to denial of service.

Affected Products

• libgphoto2 versions up to and including 2.5.33
• Systems using libgphoto2 for camera communication via PTP2 protocol
• Applications built on libgphoto2 that process camera events

Discovery Timeline

• 2026-04-18 - CVE CVE-2026-40333 published to NVD
• 2026-04-20 - Last updated in NVD database

Technical Details for CVE-2026-40333

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-bounds Read), affecting the PTP2 camera library within libgphoto2. The core issue lies in the architecture of two functions within camlibs/ptp2/ptp-pack.c that process camera event data. These functions accept raw data pointers for buffer access but lack a corresponding length parameter that would enable bounds checking.

The vulnerability requires physical access to exploit, meaning an attacker would need to connect a malicious or modified camera device to the target system. Once connected, specially crafted PTP2 event data could trigger reads beyond allocated buffer boundaries, potentially exposing sensitive memory contents or causing the application to crash.

The impact is twofold: unauthorized disclosure of potentially sensitive information residing in adjacent memory regions, and the possibility of application instability or denial of service through memory access violations.

Root Cause

The root cause is an architectural design flaw where buffer size information is not propagated through the function call chain. The ptp_unpack_EOS_events() function has access to xsize (the buffer size), but this critical boundary information is never passed to the downstream functions that perform the actual data reads. Without knowledge of the buffer's extent, these functions cannot implement proper bounds checking, leading to unbounded read operations.

Attack Vector

The attack vector requires physical access to the target system. An attacker would need to:

1. Connect a malicious camera or USB device emulating a PTP2-compatible camera
2. Trigger camera event processing through the libgphoto2 library
3. Send malformed PTP2 event data designed to cause out-of-bounds reads

The vulnerability mechanism involves crafted input that causes the unpacking functions to read beyond the allocated buffer. Since no realCodeExamples are available, refer to the GitHub Security Advisory for technical implementation details and the patch commit for specifics on the vulnerable code patterns.

Detection Methods for CVE-2026-40333

Indicators of Compromise

• Unexpected application crashes in processes using libgphoto2 when camera devices are connected
• Memory access violations or segmentation faults in camera-related applications
• Suspicious USB device connections that do not correspond to legitimate camera hardware
• Abnormal memory consumption patterns in libgphoto2-dependent processes

Detection Strategies

• Monitor system logs for segmentation faults or memory access errors in applications using libgphoto2
• Implement USB device monitoring to detect unauthorized or unexpected camera device connections
• Use application crash analysis tools to identify patterns consistent with out-of-bounds read exploitation
• Deploy endpoint protection capable of detecting memory corruption attempts

Monitoring Recommendations

• Enable verbose logging for camera access libraries and USB subsystems
• Configure endpoint detection and response (EDR) solutions to alert on memory safety violations in libgphoto2 processes
• Monitor for unusual USB device enumeration events, particularly PTP-class devices
• Implement hardware asset management to track authorized camera equipment

How to Mitigate CVE-2026-40333

Immediate Actions Required

• Update libgphoto2 to a version containing commit 1817ecead20c2aafa7549dac9619fe38f47b2f53 or later
• Restrict physical access to systems running vulnerable versions of libgphoto2
• Disable automatic camera mounting on critical systems until patching is complete
• Review and audit applications that depend on libgphoto2 for potential exposure

Patch Information

The vulnerability has been addressed in commit 1817ecead20c2aafa7549dac9619fe38f47b2f53. This patch modifies the affected functions to accept and validate buffer length parameters, ensuring that read operations respect the actual buffer boundaries. Organizations should update to the latest version of libgphoto2 that includes this fix. For detailed patch information, refer to the GitHub commit and the GitHub Security Advisory GHSA-hq94-cp6h-3gjp.

Workarounds

• Disable USB camera support on systems where camera functionality is not required
• Implement strict physical access controls to prevent unauthorized device connections
• Use USB device whitelisting to allow only known and trusted camera devices
• Consider using USB data blockers or disabling USB ports on high-security systems

# Configuration example
# Disable USB autosuspend for camera devices (reduces attack surface)
echo "blacklist usbcamera" | sudo tee /etc/modprobe.d/disable-camera.conf

# Alternatively, use udev rules to restrict camera device access
# Add to /etc/udev/rules.d/99-camera-restrict.rules
# SUBSYSTEM=="usb", ATTR{bInterfaceClass}=="06", MODE="0000"