CVE-2026-40334: libgphoto2 Buffer Overflow Vulnerability

CVE-2026-40334 Overview

CVE-2026-40334 is a missing null terminator vulnerability in libgphoto2, a camera access and control library. The flaw exists in the ptp_unpack_Canon_FE() function within camlibs/ptp2/ptp-pack.c at line 1377. The function copies a filename into a 13-byte buffer using strncpy without explicitly null-terminating the result. If the source data is exactly 13 bytes with no null terminator, the buffer is left unterminated, leading to out-of-bounds reads in any subsequent string operation.

Critical Impact

Missing null termination can cause out-of-bounds memory reads when processing Canon camera folder entries, potentially leaking sensitive memory contents or causing application crashes.

Affected Products

• libgphoto2 versions up to and including 2.5.33
• Applications using libgphoto2 for Canon camera communication via PTP protocol
• Linux distributions packaging vulnerable libgphoto2 versions

Discovery Timeline

• 2026-04-18 - CVE CVE-2026-40334 published to NVD
• 2026-04-20 - Last updated in NVD database

Technical Details for CVE-2026-40334

Vulnerability Analysis

This vulnerability stems from improper string handling in C code that processes Canon camera folder entries via the Picture Transfer Protocol (PTP). The ptp_unpack_Canon_FE() function is responsible for unpacking folder entry data received from Canon cameras, including extracting the filename field into a fixed-size buffer.

The root issue lies in the use of strncpy() without explicit null termination. While strncpy() is often used as a "safer" alternative to strcpy(), it does not guarantee null termination when the source string length equals or exceeds the destination buffer size. This is a common C programming pitfall that can lead to memory safety issues.

When a malicious or malformed camera device provides exactly 13 bytes of non-null filename data, the destination buffer fe->Filename lacks proper null termination. Any subsequent string operations on this buffer will read beyond its bounds, searching for a null terminator that doesn't exist within the allocated memory.

Root Cause

The vulnerability is classified as CWE-170 (Improper Null Termination). The strncpy() function copies up to PTP_CANON_FilenameBufferLen bytes from the source to the destination buffer but does not append a null terminator if the source string fills the entire buffer. This leaves the buffer in an undefined state for string operations that expect null-terminated strings.

Attack Vector

Exploitation requires physical access to connect a malicious or modified camera device to the target system. An attacker would need to craft a camera or camera emulator that sends specifically malformed PTP folder entry data containing a 13-byte filename without null termination. When the libgphoto2 library processes this data, subsequent string operations may:

• Read beyond the buffer boundary, exposing adjacent memory contents
• Cause application crashes due to accessing unmapped memory
• Lead to undefined behavior in applications using the library

The physical access requirement significantly limits the attack surface, making remote exploitation infeasible without additional vulnerabilities.

 	fe->ObjectSize       = dtoh32a(data + PTP_cfe_ObjectSize);
 	fe->Time     = (time_t)dtoh32a(data + PTP_cfe_Time);
 	strncpy(fe->Filename, (char*)data + PTP_cfe_Filename, PTP_CANON_FilenameBufferLen);
+	fe->Filename[PTP_CANON_FilenameBufferLen-1] = '\0';
 }
 
 /*

Source: GitHub Commit 259fc7d3

Detection Methods for CVE-2026-40334

Indicators of Compromise

• Unexpected crashes or segmentation faults in applications using libgphoto2 when connecting Canon cameras
• Memory access violations logged during PTP communication sessions
• Anomalous camera device connections that trigger application errors

Detection Strategies

• Monitor for application crashes with stack traces pointing to ptp_unpack_Canon_FE() or related PTP unpacking functions
• Use AddressSanitizer (ASan) during development and testing to detect out-of-bounds reads
• Implement USB device monitoring to detect unauthorized or suspicious camera connections

Monitoring Recommendations

• Enable system logging for USB device connections and camera access events
• Deploy endpoint detection solutions that monitor for memory access violations in photography-related applications
• Review application logs for repeated failures when processing Canon camera folder entries

How to Mitigate CVE-2026-40334

Immediate Actions Required

• Update libgphoto2 to a version that includes commit 259fc7d3bfe534ce4b114c464f55b448670ab873
• Rebuild applications statically linked against libgphoto2 with the patched version
• Apply available distribution security updates for libgphoto2 packages

Patch Information

The vulnerability is patched in commit 259fc7d3bfe534ce4b114c464f55b448670ab873. The fix explicitly sets the last byte of the filename buffer to null after the strncpy() call, ensuring proper string termination regardless of source data length. Organizations should apply this patch or upgrade to a libgphoto2 release that includes this fix.

For more details, see the GitHub Security Advisory and the patch commit.

Workarounds

• Restrict physical access to systems running libgphoto2-based applications
• Disable or limit USB camera connections on sensitive systems where possible
• Use USB device whitelisting to allow only known trusted camera devices

# Configuration example - Restrict USB camera access via udev rules
# Create /etc/udev/rules.d/99-restrict-cameras.rules
# Block unknown USB devices claiming to be cameras
SUBSYSTEM=="usb", ATTR{bInterfaceClass}=="06", MODE="0000"
# Allow only specific trusted camera vendors (example: Canon VID 04a9)
SUBSYSTEM=="usb", ATTR{idVendor}=="04a9", MODE="0660", GROUP="camera"