CVE-2026-40333

A flaw was found in libgphoto2, a library used for camera access and control. Two functions within the library's Picture Transfer Protocol (PTP) handling component do not properly validate the size of data being read, allowing for unbounded reads. A local attacker with physical access to a system utilizing libgphoto2 could exploit this vulnerability. This could lead to the disclosure of sensitive information from memory or cause the application to crash, resulting in a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, restrict physical access to systems running libgphoto2. If camera access and control via libgphoto2 is not required, consider removing the libgphoto2 package to eliminate the attack surface.