https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-06T07:36:51.603081+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-40333 CVE-2026-40333 — libgphoto2 has OOB read in ptp_unpack_EOS_ImageFormat() and ptp_unpack_EOS_CustomFuncEx() due to missing length paramet… 2026-10-06T07:36:51.605392+00:00

Affected: gphoto libgphoto2

libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, two functions in camlibs/ptp2/ptp-pack.c accept a data pointer but no length parameter, performing unbounded reads. Their callers in ptp_unpack_EOS_events() have xsize available but never pass it, leaving both functions unable to validate reads against the actual buffer boundary. Commit 1817ecead20c2aafa7549dac9619fe38f47b2f53 patches the issue.

 https://vulnerability.circl.lu/vuln/usn-8586-1 USN-8586-1 — libgphoto2 vulnerabilities 2026-10-06T07:36:51.605481+00:00

Affected: Ubuntu:22.04:LTS: libgphoto2, Ubuntu:24.04:LTS: libgphoto2, Ubuntu:26.04:LTS: libgphoto2

It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing EOS image format data. An attacker with physical access could possibly use this issue to obtain sensitive information. (CVE-2026-40333)

It was discovered that libgphoto2 did not properly null-terminate buffers when parsing Canon folder entries. An attacker with physical access could possibly use this issue to obtain sensitive information. (CVE-2026-40334)

It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing device property values. An attacker with physical access could possibly use this issue to obtain sensitive information. (CVE-2026-40335)

It was discovered that libgphoto2 had a memory leak when parsing Sony device property descriptors. An attacker with physical access could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-40336)

It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing Sony device property enumeration data. An attacker with physical access could possibly use this issue to obtain sensitive information. (CVE-2026-40338)

It was discovered that libgphoto2 did not properly validate buffer boundaries when parsing Sony device property form flags. An attacker with physical access could possibly use this issue to obtain sensitive information. (CVE-2026-40339)

It was discovered that libgphoto2 did not properly validate buffer boundaries when p…