CVE-2026-40339

A flaw was found in libgphoto2, a library for camera access and control. An out-of-bounds read vulnerability exists in the ptp_unpack_Sony_DPD() function due to a missing bounds check when reading the FormFlag byte. This flaw could allow an attacker to disclose sensitive information from memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If camera interaction is not required, remove the libgphoto2 package to eliminate this vulnerability. Alternatively, avoid connecting untrusted cameras or processing untrusted image data through applications that utilize libgphoto2. This operational control reduces exposure by limiting the attack surface.