CVE catalog

CVE-2026-40336

Severity: Medium · CVSS 4.3CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published: Apr 17, 2026, 11:27:42 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.18% · Oct 27, 2026

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (lines 884–885). When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd->FORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation from line 857. The original array and any string values it contains are leaked on every property descriptor parse. Commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libgphoto2	sid	`2.5.34-2`	fixed
Debian	libgphoto2	forky	`2.5.34-2`	fixed
Debian	libgphoto2	trixie	`2.5.31-4`	vulnerable
Debian	libgphoto2	bookworm	`2.5.30-1`	vulnerable
Cpe	libgphoto2	Not reported	Not reported	vulnerable
Ubuntu	libgphoto2	noble	`2.5.31-2.1ubuntu1.1`	fixed
Ubuntu	libgphoto2-6t64	noble	`2.5.31-2.1ubuntu1.1`	fixed
Ubuntu	libgphoto2-dev	noble	`2.5.31-2.1ubuntu1.1`	fixed
Ubuntu	libgphoto2-dev-doc	noble	`2.5.31-2.1ubuntu1.1`	fixed
Ubuntu	libgphoto2-l10n	noble	`2.5.31-2.1ubuntu1.1`	fixed
Ubuntu	libgphoto2-port12t64	noble	`2.5.31-2.1ubuntu1.1`	fixed
Ubuntu	libgphoto2	25.10	`2.5.31-4`	vulnerable
Ubuntu	libgphoto2	25.10	`2.5.31-4build1`	vulnerable
Ubuntu	libgphoto2	25.10	`2.5.31-4ubuntu1`	vulnerable
Ubuntu	libgphoto2	26.04	`2.5.31-4build1`	vulnerable
Ubuntu	libgphoto2	26.04	`2.5.32-1`	vulnerable
Ubuntu	libgphoto2	26.04	`2.5.33-1`	vulnerable
Ubuntu	libgphoto2	26.04	`2.5.33-1ubuntu1`	vulnerable
Ubuntu	libgphoto2	26.04	`2.5.33-1ubuntu1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libgphoto2	source	sid	`2.5.34-1`	not yet assigned	Not reported	[1134329]
Debian	libgphoto2	source	forky	`2.5.34-1`	not yet assigned	Not reported	[1134329]
Debian	libgphoto2	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1134329]
Debian	libgphoto2	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1134329]
Ubuntu	libgphoto2	deb	noble	`2.5.31-2.1ubuntu1.1`	Not reported	Not reported	Not reported
Ubuntu	libgphoto2-6t64	deb	noble	`2.5.31-2.1ubuntu1.1`	Not reported	Not reported	Not reported
Ubuntu	libgphoto2-dev	deb	noble	`2.5.31-2.1ubuntu1.1`	Not reported	Not reported	Not reported
Ubuntu	libgphoto2-dev-doc	deb	noble	`2.5.31-2.1ubuntu1.1`	Not reported	Not reported	Not reported
Ubuntu	libgphoto2-l10n	deb	noble	`2.5.31-2.1ubuntu1.1`	Not reported	Not reported	Not reported
Ubuntu	libgphoto2-port12t64	deb	noble	`2.5.31-2.1ubuntu1.1`	Not reported	Not reported	Not reported
Ubuntu	libgphoto2	deb	26.04	`2.5.33-1ubuntu1.1`	Not reported	UBUNTU-CVE-2026-40336	Not reported

[Debian bug #1134329]

Notes

[trixie] libgphoto2: Minor issue [bookworm] libgphoto2: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libgphoto2-6]Affected
Source package: [libgphoto2]
Details (2)
- 2.5.30-1 · amd64 · bookworm
  Affected
  nvd · libgphoto2 · debian · bookworm; nvd · libgphoto2 · debian · 12
- 2.5.30-1 · arm64 · bookworm
  Affected
  nvd · libgphoto2 · debian · bookworm; nvd · libgphoto2 · debian · 12
[libgphoto2-dev]Affected
Source package: [libgphoto2]
Details (2)
- 2.5.30-1 · amd64 · bookworm
  Affected
  nvd · libgphoto2 · debian · bookworm; nvd · libgphoto2 · debian · 12
- 2.5.30-1 · arm64 · bookworm
  Affected
  nvd · libgphoto2 · debian · bookworm; nvd · libgphoto2 · debian · 12
[libgphoto2-dev-doc]Affected
Source package: [libgphoto2]
Details (2)
- 2.5.30-1 · all · bookworm
  Affected
  nvd · libgphoto2 · debian · bookworm; nvd · libgphoto2 · debian · 12
- 2.5.30-1 · all · bookworm
  Affected
  nvd · libgphoto2 · debian · bookworm; nvd · libgphoto2 · debian · 12
[libgphoto2-l10n]Affected
Source package: [libgphoto2]
Details (2)
- 2.5.30-1 · all · bookworm
  Affected
  nvd · libgphoto2 · debian · bookworm; nvd · libgphoto2 · debian · 12
- 2.5.30-1 · all · bookworm
  Affected
  nvd · libgphoto2 · debian · bookworm; nvd · libgphoto2 · debian · 12
[libgphoto2-port12]Affected
Source package: [libgphoto2]
Details (2)
- 2.5.30-1 · amd64 · bookworm
  Affected
  nvd · libgphoto2 · debian · bookworm; nvd · libgphoto2 · debian · 12
- 2.5.30-1 · arm64 · bookworm
  Affected
  nvd · libgphoto2 · debian · bookworm; nvd · libgphoto2 · debian · 12

[Debian 13 (Trixie)]

[libgphoto2-6t64]Affected
Source package: [libgphoto2]
Details (2)
- 2.5.31-4 · amd64 · trixie
  Affected
  nvd · libgphoto2 · debian · 13
- 2.5.31-4 · arm64 · trixie
  Affected
  nvd · libgphoto2 · debian · 13
[libgphoto2-dev]Affected
Source package: [libgphoto2]
Details (2)
- 2.5.31-4 · amd64 · trixie
  Affected
  nvd · libgphoto2 · debian · 13
- 2.5.31-4 · arm64 · trixie
  Affected
  nvd · libgphoto2 · debian · 13
[libgphoto2-dev-doc]Affected
Source package: [libgphoto2]
Details (2)
- 2.5.31-4 · all · trixie
  Affected
  nvd · libgphoto2 · debian · 13
- 2.5.31-4 · all · trixie
  Affected
  nvd · libgphoto2 · debian · 13
[libgphoto2-l10n]Affected
Source package: [libgphoto2]
Details (2)
- 2.5.31-4 · all · trixie
  Affected
  nvd · libgphoto2 · debian · 13
- 2.5.31-4 · all · trixie
  Affected
  nvd · libgphoto2 · debian · 13
[libgphoto2-port12t64]Affected
Source package: [libgphoto2]
Details (2)
- 2.5.31-4 · amd64 · trixie
  Affected
  nvd · libgphoto2 · debian · 13
- 2.5.31-4 · arm64 · trixie
  Affected
  nvd · libgphoto2 · debian · 13

Observed: Oct 23, 2026, 10:32:47 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]