CVE-2026-40338: libgphoto2 Buffer Overflow Vulnerability

CVE-2026-40338 Overview

CVE-2026-40338 is an out-of-bounds read vulnerability in libgphoto2, a widely-used camera access and control library. The vulnerability exists in the ptp_unpack_Sony_DPD() function within camlibs/ptp2/ptp-pack.c at line 856. When processing PTP (Picture Transfer Protocol) device property descriptions from Sony cameras, the function reads a 2-byte enumeration count using dtoh16o(data, *poffset) without first verifying that 2 bytes remain in the buffer. This missing boundary check allows an attacker with physical access to a system to potentially read sensitive memory contents or cause application instability.

Critical Impact

An attacker with physical access can exploit this vulnerability through a malicious or compromised camera device to trigger out-of-bounds memory reads, potentially exposing sensitive information or causing denial of service conditions in applications using libgphoto2.

Affected Products

• libgphoto2 versions up to and including 2.5.33
• Applications and services that integrate libgphoto2 for camera communication
• Linux distributions and systems with libgphoto2 installed for camera support

Discovery Timeline

• 2026-04-18 - CVE-2026-40338 published to NVD
• 2026-04-20 - Last updated in NVD database

Technical Details for CVE-2026-40338

Vulnerability Analysis

The vulnerability stems from an oversight in the Sony-specific PTP device property descriptor unpacking code. The standard ptp_unpack_DPD() function at line 704 in the same file properly validates buffer boundaries before reading data. However, the Sony variant ptp_unpack_Sony_DPD() was implemented without this crucial safety check.

When the function encounters a PTP_DPFF_Enumeration case, it immediately attempts to read a 2-byte enumeration count N from the buffer using dtoh16o(data, *poffset). Without verifying that at least 2 bytes remain in the buffer, this operation can read beyond the allocated buffer boundaries, triggering an out-of-bounds read condition (CWE-125).

The physical attack vector requires an attacker to connect a malicious or specially crafted camera device to the target system. When the system attempts to communicate with the device via libgphoto2, the malformed PTP response data can trigger the vulnerable code path.

Root Cause

The root cause is a missing buffer boundary validation in the Sony-specific PTP unpacking function. The standard implementation correctly validates buffer size before reading, but this check was omitted in the ptp_unpack_Sony_DPD() function, likely due to developer oversight when implementing vendor-specific functionality. This represents a classic case of inconsistent security practices between related code paths.

Attack Vector

The vulnerability requires physical access to the target system. An attacker would need to connect a malicious camera device or a device emulating a Sony camera with crafted PTP responses. When libgphoto2 processes these malformed responses, the out-of-bounds read is triggered in the enumeration count parsing logic.

The attack scenario involves:

1. Attacker crafts a malicious USB device that emulates a Sony camera
2. The device is connected to a target system running libgphoto2
3. When the system queries device properties via PTP, the malicious device returns a truncated or malformed response
4. The ptp_unpack_Sony_DPD() function attempts to read the enumeration count without proper bounds checking
5. Memory beyond the buffer is read, potentially exposing sensitive data or causing a crash

Detection Methods for CVE-2026-40338

Indicators of Compromise

• Unexpected crashes or segmentation faults in applications using libgphoto2 during camera communication
• Unusual USB device connection events, particularly devices identifying as Sony cameras
• Memory access violations logged by system monitoring tools when libgphoto2 processes device data
• Core dumps or crash reports from gphoto2-related processes showing faults in ptp_unpack_Sony_DPD() or related functions

Detection Strategies

• Monitor for unusual USB device enumeration events, especially those presenting as Sony PTP devices
• Implement application crash monitoring for processes utilizing libgphoto2
• Deploy endpoint detection solutions that can identify anomalous USB device behavior
• Review system logs for libgphoto2-related segmentation faults or memory access errors

Monitoring Recommendations

• Enable USB device logging to track camera connections and disconnections
• Configure crash reporting tools to capture and analyze libgphoto2-related failures
• Implement endpoint protection that monitors for exploitation of memory corruption vulnerabilities
• Establish baseline behavior for camera-related processes to detect anomalies

How to Mitigate CVE-2026-40338

Immediate Actions Required

• Update libgphoto2 to a version containing the security fix (commit 3b9f9696be76ae51dca983d9dd8ce586a2561845)
• Restrict physical access to systems where unauthorized USB device connections could pose a risk
• Consider disabling USB ports or implementing USB device whitelisting on sensitive systems
• Review and update policies for connecting external devices to critical systems

Patch Information

The vulnerability has been fixed in commit 3b9f9696be76ae51dca983d9dd8ce586a2561845. This patch adds the missing buffer boundary check to the ptp_unpack_Sony_DPD() function, bringing it in line with the security practices already implemented in the standard ptp_unpack_DPD() function.

For detailed information about the fix, refer to:

• GitHub Commit with Fix
• GitHub Security Advisory GHSA-2hwp-w84q-27hf

Workarounds

• Implement USB device whitelisting to only allow known, trusted camera devices
• Disable automatic mounting and enumeration of USB devices on sensitive systems
• Use physical USB port blockers on systems in high-risk environments
• Consider running camera-related applications in sandboxed environments to limit potential impact

# Example: Disable automatic USB device handling on Linux systems
# Add udev rule to ignore unknown camera devices
echo 'SUBSYSTEM=="usb", ATTR{idVendor}=="054c", MODE="0000"' | sudo tee /etc/udev/rules.d/99-block-sony-cameras.rules
sudo udevadm control --reload-rules