CVE-2026-40339: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-40339 is an out-of-bounds read vulnerability in libgphoto2, a camera access and control library, affecting versions up to and including 2.5.33. The flaw resides in the ptp_unpack_Sony_DPD() function in camlibs/ptp2/ptp-pack.c (line 842), where the FormFlag byte is read without a prior bounds check — an oversight absent in the standard ptp_unpack_DPD() counterpart. The vulnerability was published on April 17–18, 2026, and assigned by GitHub Security. It carries a CVSS v3.1 base score of 5.2 (Medium) with a physical attack vector (GitHub Advisory, Red Hat Bugzilla).

The root cause is CWE-125 (Out-of-bounds Read): ptp_unpack_Sony_DPD() calls dtoh8o(data, *poffset) to read the FormFlag byte without first validating that *poffset + sizeof(uint8_t) > dpdlen, a check that the standard ptp_unpack_DPD() correctly performs at lines 686–687 of the same file. An attacker exploits this by presenting a rogue PTP/IP server or a malicious USB device that sends a crafted Sony Device Property Descriptor with a truncated buffer; when the host enumerates device properties, the missing bounds check causes one byte of adjacent heap memory to be read beyond the buffer boundary. Physical or local access to connect a malicious device is required as a precondition. The fix, committed as 09f8a940b1e418b5693f5c11e3016a1ad2cea62d, inserts the missing bounds check immediately before the dtoh8o call (GitHub Advisory, Fix Commit).

Successful exploitation results in the disclosure of one byte of adjacent heap memory per Sony device property enumeration, potentially leaking sensitive in-memory data such as pointers, keys, or other application state. A secondary impact is a potential denial of service through application crash if the out-of-bounds read triggers a fault. Because the attack vector is physical and the scope is unchanged, lateral movement or remote data exfiltration are not direct consequences, but heap memory disclosure could assist in chaining further exploitation (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.007% (0.000070), reflecting very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported (GitHub Advisory).

1. Acquire or craft a malicious device: Prepare a rogue USB device or PTP/IP server that emulates a Sony camera and is capable of sending crafted PTP Device Property Descriptor (DPD) responses with a truncated buffer.
2. Connect to the target system: Physically connect the malicious USB device to a host system running libgphoto2 ≤ 2.5.33, or position a rogue PTP/IP server on the same network segment accessible to the target.
3. Trigger device property enumeration: Use any application that calls libgphoto2 to enumerate camera properties (e.g., gphoto2 --list-config or any photo management application), causing ptp_unpack_Sony_DPD() to be invoked.
4. Trigger the OOB read: The crafted DPD response causes ptp_unpack_Sony_DPD() to call dtoh8o(data, *poffset) without bounds validation, reading one byte beyond the buffer boundary and exposing adjacent heap memory.
5. Collect leaked data: Observe the leaked byte through error output, logging, or by monitoring the application's behavior; repeat enumeration across multiple properties to accumulate additional heap memory bytes (GitHub Advisory, Fix Commit).

• Physical/USB: Unexpected or unrecognized USB devices connected to systems running libgphoto2, particularly devices presenting as Sony cameras.
• Logs: Application crashes or segmentation faults in processes using libgphoto2 when enumerating Sony camera properties; error messages referencing ptp_unpack_Sony_DPD or ptp-pack.c.
• Process: Unusual invocations of gphoto2 or photo management daemons (e.g., gvfs-gphoto2-volume-monitor) triggered by newly connected USB devices without user initiation.
• Network: Unexpected PTP/IP connection attempts (TCP port 15740) from unknown hosts to systems running libgphoto2 in network-connected camera mode.

Upgrade libgphoto2 to a version newer than 2.5.33 that includes the fix introduced in commit 09f8a940b1e418b5693f5c11e3016a1ad2cea62d. Distribution-specific patches are being tracked via Red Hat Bugzilla (BZ#2459357) and an openSUSE security announcement has also been issued. As a workaround, restrict physical access to systems running libgphoto2 and disable automatic camera enumeration or USB auto-mount for untrusted devices; if Sony camera support is not required, consider disabling the PTP2 camera library module (Fix Commit, Red Hat Bugzilla).

The vulnerability was reported by researcher Sebastián Alba (credited as "Sebasteuo" in the GitHub advisory) and published by the libgphoto2 maintainer msmeissn on April 15, 2026. Red Hat triaged it as medium severity and opened a tracking bug. No significant broader media coverage or notable social media discussion has been observed, consistent with the physical-access-only attack vector and moderate severity rating (GitHub Advisory, Red Hat Bugzilla).