CVE-2026-40341: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-40341 is an out-of-bounds read vulnerability in libgphoto2, a camera access and control library, affecting versions up to and including 2.5.33. The flaw resides in the ptp_unpack_EOS_FocusInfoEx function and can be triggered by processing input from untrusted USB devices, potentially causing a crash or leaking memory contents. It was published on April 17–18, 2026, with a patch committed to the upstream repository shortly after. The vulnerability carries a CVSS v3.1 base score of 3.5 (Low), reflecting its physical attack vector requirement (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-125 (Out-of-bounds Read) and CWE-126 (Buffer Over-read). In the vulnerable code path, ptp_unpack_EOS_FocusInfoEx in camlibs/ptp2/ptp-pack.c read multiple field values (size, halfsize, version, focus point counts, and dimensions) from a data buffer before validating that the buffer was large enough to contain them — specifically, it did not check that datasize >= 4 before reading the 32-bit size field, nor did it defer reading subsequent fields until after the size validity check. The patch (commit c385b34) reorders the reads so that bounds checks are performed before any field values are extracted from the buffer (GitHub Commit, GitHub Advisory). Exploitation requires physical access to connect a crafted or malicious USB camera device to a system running a vulnerable version of libgphoto2.

Successful exploitation can cause libgphoto2 to crash, resulting in a denial of service for any application relying on the library for camera access (e.g., image management software, scanning tools). Additionally, the out-of-bounds read may expose adjacent memory contents to an attacker with physical access, creating a limited confidentiality risk. Integrity is not affected, and the overall impact is constrained by the requirement for physical USB access, limiting the scope of potential damage (GitHub Advisory, Red Hat Bugzilla).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is extremely low at approximately 0.005%, reflecting the minimal likelihood of automated exploitation. Exploitation is further constrained by the physical attack vector — an attacker must have direct USB access to the target system with a specially crafted device.

1. Physical Access: Obtain physical access to a system running a vulnerable version of libgphoto2 (≤ 2.5.33) with a USB port available.
2. Craft Malicious USB Device: Prepare a USB device (e.g., a modified or emulated USB camera) that responds to PTP (Picture Transfer Protocol) commands with a crafted EOS_FocusInfoEx response payload — specifically, a buffer smaller than 4 bytes or with an inconsistent size field to trigger the out-of-bounds read.
3. Connect Device: Plug the malicious USB device into the target system. When libgphoto2 (or an application using it) enumerates or communicates with the device, it will invoke ptp_unpack_EOS_FocusInfoEx.
4. Trigger OOB Read: The crafted PTP response causes the function to read beyond the allocated buffer before performing size validation, resulting in a crash (DoS) or potential memory disclosure (GitHub Advisory, GitHub Commit).

• Process: Unexpected crash or segmentation fault in processes using libgphoto2 (e.g., gphoto2, shotwell, digikam, gvfs-gphoto2-volume-monitor) shortly after a USB camera device is connected.
• Logs: System logs (e.g., /var/log/syslog, journalctl) showing segfault or abort signals from libgphoto2-linked processes; libgphoto2 error messages such as FocusInfoEx has invalid size in application debug output.
• USB Events: Kernel logs (dmesg) showing connection of an unrecognized or unusual USB device with a camera-class descriptor immediately preceding a crash event.

Update libgphoto2 to a version newer than 2.5.33 that includes the fix from commit c385b34af260595dfbb5f9329526be5158985987. The upstream patch is available directly in the libgphoto2 repository, and downstream distributions (e.g., openSUSE) have begun issuing updated packages (openSUSE Security, Red Hat Bugzilla). No configuration-based workarounds are available; the vendor advisory explicitly states no workarounds exist. As an operational control, restrict physical USB access to trusted devices only, and consider disabling USB camera functionality on systems where it is not required (GitHub Advisory).

The vulnerability was assigned a Low severity rating by the upstream maintainer (msmeissn) and Red Hat, reflecting its limited exploitability due to the physical access requirement. Red Hat tracked it via Bugzilla with a medium priority/severity classification (Red Hat Bugzilla). No significant public researcher commentary, social media discussion, or major media coverage has been observed for this low-severity issue.