CVE-2026-40334 libgphoto2 missing null termination in ptp_unpack_Canon_FE() filename buffer in ptp-pack.c
A missing null terminator in libgphoto2 allows out-of-bounds reads, potentially disclosing sensitive memory contents to attackers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40334?
CVE-2026-40334 is a low-severity vulnerability in libgphoto2, published on 17 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in ptp_unpack_Canon_FE() in camlibs/ptp2/ptp-pack.c (line 1377). The function copies a filename into a 13-byte buffer using strncpy without explicitly null-terminating the result. If the source data is exactly 13 bytes with no null terminator, the buffer is left unterminated, leading to out-of-bounds reads in any subsequent string operation. Commit 259fc7d3bfe534ce4b114c464f55b448670ab873 patches the issue.
Weakness: CWE-170
Which versions are affected by CVE-2026-40334?
How do I fix CVE-2026-40334?
Apply the vendor's patch.
Is CVE-2026-40334 being exploited?
There is no known exploitation of CVE-2026-40334 in the wild and no public exploit code.
Sources
Also known as AZL-83012, DEBIAN-CVE-2026-40334, GHSA-ph87-cc3j-c6hm, UBUNTU-CVE-2026-40334.