CVE-2026-40338

A flaw was found in libgphoto2, a library for camera access and control. An out-of-bounds read vulnerability exists in the ptp_unpack_Sony_DPD() function. This occurs when the function attempts to read a 2-byte enumeration count without first verifying that sufficient data remains in the buffer. A local attacker or a malicious device connected to the system could exploit this to potentially disclose sensitive information from memory or cause a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, restrict physical access to systems running libgphoto2 and avoid connecting untrusted or malicious devices. This operational control limits the attack surface by preventing the necessary physical interaction or device connection required for exploitation.