CVE-2026-40340

libgphoto2: libgphoto2: Information disclosure and denial of service via out-of-bounds read

Loading…

Severity

Moderate

Red Hat Product Security

6.1

CVSS 3.1

Review impact separately from score.

Published · April 18, 2026

Updated · July 3, 2026

Description

A flaw was found in libgphoto2, a library for camera access and control. An out-of-bounds read vulnerability exists in the ptp_unpack_OI() function due to insufficient validation. A local attacker could exploit this by crafting specific input related to the Samsung Galaxy 64-bit objectsize detection heuristic. This could lead to information disclosure or a denial of service by causing the application to crash.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 6.1
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

CWE-125 · Out-of-bounds Read