CVE-2026-40336: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-40336 is a memory leak vulnerability in libgphoto2, a camera access and control library, affecting versions up to and including 2.5.33. The flaw resides in the ptp_unpack_Sony_DPD() function in camlibs/ptp2/ptp-pack.c (lines 884–885), where a secondary enumeration list introduced by 2024+ Sony cameras causes a previously allocated buffer to be overwritten without being freed. The vulnerability was published on April 17–18, 2026, and reported by researcher Sebastián Alba. It carries a CVSS v3.1 base score of 2.4 (Low) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime) and CWE-772 (Missing Release of Resource after Effective Lifetime). In ptp_unpack_Sony_DPD(), the first allocation of dpd->FORM.Enum.SupportedValue occurs at line 857 via calloc(); when a secondary enumeration list is present (a feature of 2024+ Sony cameras), lines 884–885 overwrite this pointer with a new calloc() allocation without first freeing the original buffer or its contained string values, causing a heap memory leak on every property descriptor parse. Exploitation requires physical access — an attacker must connect a malicious or specially crafted Sony camera device to a host running the vulnerable library and trigger repeated property descriptor responses to cause unbounded heap growth. The fix (commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6) inserts a loop to free each SupportedValue element and then frees the array before the new allocation (GitHub Advisory, Fix Commit).

Successful exploitation can cause the libgphoto2 host process to consume unbounded heap memory, ultimately leading to memory exhaustion and denial of service on the affected system. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability. Because physical access to a camera connection is required, the attack surface is narrow and lateral movement or data exfiltration are not applicable concerns (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is extremely low at 0.000060, reflecting the minimal likelihood of automated exploitation. Physical access to the target system is a hard prerequisite, significantly limiting the practical attack surface (GitHub Advisory, Red Hat Bugzilla).

1. Physical Access: Obtain physical access to a host system running libgphoto2 version 2.5.33 or earlier with a USB or PTP-capable camera port.
2. Prepare Malicious Device: Configure or emulate a Sony camera (2024+ model behavior) that responds to PTP property descriptor requests with crafted responses containing a secondary enumeration list in the ptp_unpack_Sony_DPD() parsing path.
3. Connect Device: Connect the malicious camera device to the target host, triggering libgphoto2 to enumerate camera properties via the PTP protocol.
4. Trigger Repeated Parsing: Cause the host application (e.g., gphoto2, Shotwell, or similar) to repeatedly request Sony device property descriptors, each time triggering the memory leak in ptp_unpack_Sony_DPD() at lines 884–885 of ptp-pack.c.
5. Exhaust Memory: After sufficient iterations, the accumulated unreleased heap allocations cause memory exhaustion, crashing or hanging the libgphoto2 host process and achieving denial of service (GitHub Advisory).

• Process Behavior: The libgphoto2 host process (e.g., gphoto2, shotwell, or a camera management daemon) exhibits steadily increasing memory consumption (RSS/heap) during camera enumeration operations with a connected Sony camera.
• System Logs: Out-of-memory (OOM) killer events in /var/log/syslog or dmesg referencing the libgphoto2 host process; kernel messages such as oom-kill event targeting the camera application.
• File System: Unexpected core dump files generated by the libgphoto2 host process in the working directory or /var/crash/.
• Network/USB: Repeated PTP property descriptor request/response cycles visible in USB traffic captures (e.g., via Wireshark with usbmon) involving Sony camera device descriptors with secondary enumeration list data.

Upgrade libgphoto2 to a version newer than 2.5.33 that includes the fix from commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6. As a workaround for systems that cannot be immediately patched, restrict physical access to USB/camera ports on hosts running the vulnerable library. Monitoring for memory exhaustion on systems that perform camera enumeration operations can provide early warning of exploitation attempts. An openSUSE security announcement has also been issued for downstream package updates (Fix Commit, Red Hat Bugzilla, Red Hat CVE).

The vulnerability was reported by researcher Sebastián Alba and disclosed via the GitHub Security Advisory program. Red Hat tracked it via Bugzilla and assigned medium severity. Tenable's Nessus scanner (plugin 307458) added detection for the vulnerability. No significant broader media coverage or notable community debate has been observed, consistent with the low CVSS score and limited attack surface (GitHub Advisory, Red Hat CVE).