CVE-2026-40333: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-40333 is an out-of-bounds read vulnerability in libgphoto2, a camera access and control library, affecting versions up to and including 2.5.33. The flaw resides in two functions within camlibs/ptp2/ptp-pack.c — ptp_unpack_EOS_ImageFormat() and ptp_unpack_EOS_CustomFuncEx() — which accept a data pointer but no length parameter, enabling unbounded memory reads. The vulnerability was published on April 17–18, 2026, and is patched via commit 1817ecead20c2aafa7549dac9619fe38f47b2f53. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-125 (Out-of-bounds Read) and CWE-130 (Improper Handling of Length Parameter Inconsistency). Both ptp_unpack_EOS_ImageFormat() (up to 36 bytes of unbounded reads) and ptp_unpack_EOS_CustomFuncEx() (up to 1024 bytes) accept only a data pointer without a corresponding size parameter; their callers in ptp_unpack_EOS_events() have xsize available but never pass it, leaving the functions unable to validate reads against the actual buffer boundary. The attack vector is physical (AV:P): an attacker must supply a malicious USB device or rogue PTP/IP server that sends a crafted EOS event response with a truncated buffer, triggering the out-of-bounds read. The fix adds a datasize parameter to both functions and validates all internal reads against it before proceeding (GitHub Advisory, Patch Commit).

Successful exploitation can expose up to 1024 bytes of adjacent heap memory, potentially disclosing sensitive in-memory data such as credentials, keys, or other application state. The ptp_unpack_EOS_CustomFuncEx() variant is the most severe due to its large potential read range. Additionally, the unbounded memory access can cause application crashes, resulting in denial-of-service conditions. Because the attack vector is physical, lateral movement risk is limited, but the confidentiality and availability impacts are rated High (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.019%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Physical access to the target system is required, significantly limiting the attacker pool (GitHub Advisory, Feedly).

1. Prepare a malicious device: Configure a rogue USB device or PTP/IP server to emulate a Canon EOS camera and craft a malformed EOS event response with a truncated data buffer for PTP_DPC_CANON_EOS_ImageFormat or PTP_DPC_CANON_EOS_CustomFuncEx properties.
2. Gain physical access: Connect the malicious USB device to a target system running a vulnerable version of libgphoto2 (≤ 2.5.33), or position a rogue PTP/IP server on the same network segment.
3. Trigger event parsing: Initiate a PTP session so that the host application calls ptp_unpack_EOS_events(), which in turn invokes ptp_unpack_EOS_ImageFormat() or ptp_unpack_EOS_CustomFuncEx() with the crafted truncated buffer.
4. Exploit unbounded read: Because neither function validates reads against the buffer boundary, they will read beyond the supplied buffer — up to 36 bytes for ImageFormat and up to 1024 bytes for CustomFuncEx — exposing adjacent heap memory contents.
5. Collect leaked data: Capture the out-of-bounds data returned in the PTP response or observe application crash behavior to infer memory layout for further exploitation (GitHub Advisory).

• Network: Unexpected or malformed PTP/IP traffic from an unrecognized server, particularly EOS event responses with anomalously short payloads for ImageFormat or CustomFuncEx properties.
• Logs: Application debug logs (if PTP debug logging is enabled) showing messages such as "parsing EOS ImageFormat property failed" or "customfuncex data is larger than 1k" from libgphoto2, which may indicate crafted inputs being processed.
• Process: Unexpected crashes or segmentation faults in applications using libgphoto2 (e.g., gphoto2, Darktable, digiKam) when connecting to a camera device.
• File System: Core dump files generated by libgphoto2-linked applications following connection to an unknown USB camera device.

The issue is patched in commit 1817ecead20c2aafa7549dac9619fe38f47b2f53; users should update libgphoto2 to any version incorporating this commit (beyond 2.5.33). An openSUSE security announcement has also been issued, indicating downstream package updates are in progress. As a workaround, restrict physical access to systems using libgphoto2 and avoid connecting untrusted or unknown USB camera devices. Disabling PTP/IP camera access in environments where it is not required further reduces exposure (Patch Commit, Red Hat, openSUSE).

The vulnerability was reported by security researcher Sebastián Alba and disclosed via GitHub Security Advisories by maintainer msmeissn on April 15, 2026. Red Hat tracked the issue via Bugzilla (Bug 2459365) and classified it as medium severity. No significant broader media coverage or notable community debate has been observed beyond standard vulnerability tracking and downstream package update announcements (GitHub Advisory, Red Hat Bugzilla).