CVE-2026-40335: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-40335 is an out-of-bounds read vulnerability in libgphoto2, a camera access and control library, affecting versions up to and including 2.5.33. The flaw resides in the ptp_unpack_DPV() function in camlibs/ptp2/ptp-pack.c (lines 622–629), where the UINT128 and INT128 cases advance the buffer offset by 16 bytes without verifying that 16 bytes remain available. Disclosed on April 17–18, 2026, the vulnerability was reported by researcher Sebastián Alba and assigned a CVSS v3.1 base score of 5.2 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an insufficient bounds check (CWE-125: Out-of-bounds Read) in ptp_unpack_DPV(). The entry guard at line 609 (if (*offset >= total) return 0) only guarantees at least 1 byte is available, but the PTP_DTC_UINT128 and PTP_DTC_INT128 switch cases unconditionally advance *offset += 16 without confirming 16 bytes remain. After this unchecked advance, *offset can exceed total, causing unsigned integer wraparound in the subsequent CTVAL macro bounds check (total - *offset < sizeof(target)), which defeats the intended downstream protection and allows reading up to 15 bytes beyond the buffer boundary. Exploitation requires physical access — an attacker must present a rogue PTP/IP server or malicious USB device that sends a crafted Device Property Value with datatype PTP_DTC_UINT128 or PTP_DTC_INT128 and a buffer smaller than 16 bytes (GitHub Advisory, Patch Commit).

Successful exploitation can result in disclosure of up to 16 bytes of adjacent heap memory per crafted PTP property value response, potentially exposing sensitive in-memory data such as credentials, keys, or other application data. The unsigned wraparound additionally defeats downstream bounds checks, compounding the information disclosure risk. A secondary impact is application instability or crash (denial of service) when the out-of-bounds read triggers a fault, affecting any system relying on libgphoto2 for camera access (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The attack vector is physical (AV:P), significantly limiting the exploitable population to scenarios where an attacker can connect a malicious USB device or control a PTP/IP server reachable by the target. The EPSS score is approximately 0.007%, reflecting very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Detection coverage exists via Nessus plugin 307456 (Tenable).

1. Prepare malicious device: Configure a rogue USB device or PTP/IP server to respond with crafted PTP Device Property Value (DPV) packets specifying datatype PTP_DTC_UINT128 (0x4009) or PTP_DTC_INT128 (0x2009) with a payload buffer smaller than 16 bytes.
2. Physical access: Connect the malicious USB device to a target system running libgphoto2 ≤ 2.5.33, or position a rogue PTP/IP server on a network reachable by the target.
3. Trigger parsing: Initiate a camera enumeration or property query operation (e.g., via gphoto2 --list-config or an application using libgphoto2), causing the library to call ptp_unpack_DPV() to parse the crafted response.
4. Exploit OOB read: The insufficient entry check at line 609 passes (at least 1 byte present), and *offset += 16 advances beyond the buffer boundary. The CTVAL macro's bounds check wraps due to unsigned arithmetic, allowing the read of up to 15 bytes of adjacent heap memory.
5. Collect leaked data: Observe or capture the out-of-bounds heap data returned or logged by the application, potentially revealing sensitive in-memory content (GitHub Advisory, Patch Commit).

• Network: Unexpected PTP/IP traffic from unknown hosts to systems running libgphoto2; PTP Device Property Value responses with PTP_DTC_UINT128 or PTP_DTC_INT128 datatypes and anomalously short payloads (< 16 bytes).
• File System: Presence of libgphoto2 version 2.5.33 or earlier on the system (check via package manager or libgphoto2 --version).
• Logs: Application crash logs or core dumps originating from ptp_unpack_DPV() in camlibs/ptp2/ptp-pack.c; memory access error messages from libgphoto2-linked applications.
• Process: Unexpected termination or segmentation faults in processes using libgphoto2 (e.g., gphoto2, darktable, digikam, shotwell) following USB device connection or PTP/IP session establishment.

The issue is patched in commit 433bde9888d70aa726e32744cd751d7dbe94379a, which adds explicit bounds checks (if (total - *offset < 16) return 0;) before each 16-byte offset advance in the PTP_DTC_UINT128 and PTP_DTC_INT128 cases (Patch Commit). Organizations should update libgphoto2 to a version incorporating this commit (beyond 2.5.33) as soon as packages are available from their distribution. As interim workarounds: restrict USB connections to trusted, verified camera devices only; implement USB device whitelisting policies; disable auto-mounting of untrusted USB devices; and avoid exposing PTP/IP services to untrusted networks (Red Hat Bugzilla). openSUSE has issued a security announcement for this vulnerability (openSUSE Security).

Red Hat has tracked the vulnerability via its Bugzilla system and published a CVE advisory page, classifying it as medium severity (Red Hat CVE). openSUSE issued a security announcement to its mailing list. Tenable added detection support via Nessus plugin 307456 shortly after disclosure (Tenable). Community reaction has been limited given the physical attack vector and moderate severity rating.