CVE-2026-40334

{
  "id": "CVE-2026-40334",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-18T00:16:37.257",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in ptp_unpack_Canon_FE() in camlibs/ptp2/ptp-pack.c (line 1377). The function copies a filename into a 13-byte buffer using strncpy without explicitly null-terminating the result. If the source data is exactly 13 bytes with no null terminator, the buffer is left unterminated, leading to out-of-bounds reads in any subsequent string operation. Commit 259fc7d3bfe534ce4b114c464f55b448670ab873 patches the issue."
    },
    {
      "lang": "es",
      "value": "libgphoto2 es una biblioteca de acceso y control de cámaras. En versiones hasta la 2.5.33 inclusive, existe un terminador nulo faltante en ptp_unpack_Canon_FE() en camlibs/ptp2/ptp-pack.c (línea 1377). La función copia un nombre de archivo en un búfer de 13 bytes usando strncpy sin terminar explícitamente el resultado con un nulo. Si los datos de origen tienen exactamente 13 bytes sin un terminador nulo, el búfer queda sin terminar, lo que lleva a lecturas fuera de límites en cualquier operación de cadena posterior. El commit 259fc7d3bfe534ce4b114c464f55b448670ab873 corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "gphoto",
          "product": "libgphoto2",
          "versions": [
            {
              "version": "<= 2.5.33",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
          "baseScore": 3.5,
          "baseSeverity": "LOW",
          "attackVector": "PHYSICAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-20T13:27:56.209528Z",
          "id": "CVE-2026-40334",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-170"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/gphoto/libgphoto2/commit/259fc7d3bfe534ce4b114c464f55b448670ab873",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/gphoto/libgphoto2/security/advisories/GHSA-ph87-cc3j-c6hm",
      "source": "[email protected]"
    }
  ]
}