CVE catalog

CVE-2026-40340

Severity: Medium · CVSS 6.1CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Published: Apr 17, 2026, 11:45:17 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.22% · Oct 25, 2026

libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have an out-of-bounds read vulnerability in `ptp_unpack_OI()` in `camlibs/ptp2/ptp-pack.c` (lines 530–563). The function validates `len < PTP_oi_SequenceNumber` (i.e., len < 48) but subsequently accesses offsets 48–56, up to 9 bytes beyond the validated boundary, via the Samsung Galaxy 64-bit objectsize detection heuristic. Commit 7c7f515bc88c3d0c4098ac965d313518e0ccbe33 fixes the issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libgphoto2	sid	`2.5.34-2`	fixed
Debian	libgphoto2	forky	`2.5.34-2`	fixed
Debian	libgphoto2	trixie	`2.5.31-4`	vulnerable
Debian	libgphoto2	bookworm	`2.5.30-1`	vulnerable
Cpe	libgphoto2	Not reported	Not reported	vulnerable
Ubuntu	libgphoto2	noble	`2.5.31-2.1ubuntu1.1`	fixed
Ubuntu	libgphoto2-6t64	noble	`2.5.31-2.1ubuntu1.1`	fixed
Ubuntu	libgphoto2-dev	noble	`2.5.31-2.1ubuntu1.1`	fixed
Ubuntu	libgphoto2-dev-doc	noble	`2.5.31-2.1ubuntu1.1`	fixed
Ubuntu	libgphoto2-l10n	noble	`2.5.31-2.1ubuntu1.1`	fixed
Ubuntu	libgphoto2-port12t64	noble	`2.5.31-2.1ubuntu1.1`	fixed
Ubuntu	libgphoto2	14.04	`2.5.2-0ubuntu5`	vulnerable
Ubuntu	libgphoto2	14.04	`2.5.2-0ubuntu6`	vulnerable
Ubuntu	libgphoto2	14.04	`2.5.3.1-0ubuntu1`	vulnerable
Ubuntu	libgphoto2	14.04	`2.5.3.1-1ubuntu2`	vulnerable
Ubuntu	libgphoto2	14.04	`2.5.3.1-1ubuntu2.2`	vulnerable
Ubuntu	libgphoto2	16.04	`2.5.8-1`	vulnerable
Ubuntu	libgphoto2	16.04	`2.5.8-2`	vulnerable
Ubuntu	libgphoto2	16.04	`2.5.8-3`	vulnerable
Ubuntu	libgphoto2	16.04	`2.5.9-2`	vulnerable
Ubuntu	libgphoto2	16.04	`2.5.9-3`	vulnerable
Ubuntu	libgphoto2	18.04	`2.5.14-1`	vulnerable
Ubuntu	libgphoto2	18.04	`2.5.16-2`	vulnerable
Ubuntu	libgphoto2	20.04	`2.5.23-2`	vulnerable
Ubuntu	libgphoto2	20.04	`2.5.24-1`	vulnerable
Ubuntu	libgphoto2	20.04	`2.5.25-0ubuntu0.1`	vulnerable
Ubuntu	libgphoto2	22.04	`2.5.27-1`	vulnerable
Ubuntu	libgphoto2	22.04	`2.5.27-1build1`	vulnerable
Ubuntu	libgphoto2	22.04	`2.5.27-1build2`	vulnerable
Ubuntu	libgphoto2	22.04	`2.5.27-1ubuntu0.1`	fixed
Ubuntu	libgphoto2	24.04	`2.5.30-1`	vulnerable
Ubuntu	libgphoto2	24.04	`2.5.31-1`	vulnerable
Ubuntu	libgphoto2	24.04	`2.5.31-2`	vulnerable
Ubuntu	libgphoto2	24.04	`2.5.31-2.1build1`	vulnerable
Ubuntu	libgphoto2	24.04	`2.5.31-2.1build2`	vulnerable
Ubuntu	libgphoto2	24.04	`2.5.31-2.1ubuntu1`	vulnerable
Ubuntu	libgphoto2	24.04	`2.5.31-2.1ubuntu1.1`	fixed
Ubuntu	libgphoto2	25.10	`2.5.31-4`	vulnerable
Ubuntu	libgphoto2	25.10	`2.5.31-4build1`	vulnerable
Ubuntu	libgphoto2	25.10	`2.5.31-4ubuntu1`	vulnerable
Ubuntu	libgphoto2	26.04	`2.5.31-4build1`	vulnerable
Ubuntu	libgphoto2	26.04	`2.5.32-1`	vulnerable
Ubuntu	libgphoto2	26.04	`2.5.33-1`	vulnerable
Ubuntu	libgphoto2	26.04	`2.5.33-1ubuntu1`	vulnerable
Ubuntu	libgphoto2	26.04	`2.5.33-1ubuntu1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libgphoto2	source	sid	`2.5.34-1`	not yet assigned	Not reported	[1134329]
Debian	libgphoto2	source	forky	`2.5.34-1`	not yet assigned	Not reported	[1134329]
Debian	libgphoto2	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1134329]
Debian	libgphoto2	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1134329]
Ubuntu	libgphoto2	deb	noble	`2.5.31-2.1ubuntu1.1`	Not reported	Not reported	Not reported
Ubuntu	libgphoto2-6t64	deb	noble	`2.5.31-2.1ubuntu1.1`	Not reported	Not reported	Not reported
Ubuntu	libgphoto2-dev	deb	noble	`2.5.31-2.1ubuntu1.1`	Not reported	Not reported	Not reported
Ubuntu	libgphoto2-dev-doc	deb	noble	`2.5.31-2.1ubuntu1.1`	Not reported	Not reported	Not reported
Ubuntu	libgphoto2-l10n	deb	noble	`2.5.31-2.1ubuntu1.1`	Not reported	Not reported	Not reported
Ubuntu	libgphoto2-port12t64	deb	noble	`2.5.31-2.1ubuntu1.1`	Not reported	Not reported	Not reported
Ubuntu	libgphoto2	deb	22.04	`2.5.27-1ubuntu0.1`	Not reported	UBUNTU-CVE-2026-40340	Not reported
Ubuntu	libgphoto2	deb	24.04	`2.5.31-2.1ubuntu1.1`	Not reported	UBUNTU-CVE-2026-40340	Not reported
Ubuntu	libgphoto2	deb	26.04	`2.5.33-1ubuntu1.1`	Not reported	UBUNTU-CVE-2026-40340	Not reported

[Debian bug #1134329]

Notes

[trixie] libgphoto2: Minor issue [bookworm] libgphoto2: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libgphoto2-6]Affected
Source package: [libgphoto2]
Details (2)
- 2.5.30-1 · amd64 · bookworm
  Affected
  nvd · libgphoto2 · debian · bookworm; nvd · libgphoto2 · debian · 12
- 2.5.30-1 · arm64 · bookworm
  Affected
  nvd · libgphoto2 · debian · bookworm; nvd · libgphoto2 · debian · 12
[libgphoto2-dev]Affected
Source package: [libgphoto2]
Details (2)
- 2.5.30-1 · amd64 · bookworm
  Affected
  nvd · libgphoto2 · debian · bookworm; nvd · libgphoto2 · debian · 12
- 2.5.30-1 · arm64 · bookworm
  Affected
  nvd · libgphoto2 · debian · bookworm; nvd · libgphoto2 · debian · 12
[libgphoto2-dev-doc]Affected
Source package: [libgphoto2]
Details (2)
- 2.5.30-1 · all · bookworm
  Affected
  nvd · libgphoto2 · debian · bookworm; nvd · libgphoto2 · debian · 12
- 2.5.30-1 · all · bookworm
  Affected
  nvd · libgphoto2 · debian · bookworm; nvd · libgphoto2 · debian · 12
[libgphoto2-l10n]Affected
Source package: [libgphoto2]
Details (2)
- 2.5.30-1 · all · bookworm
  Affected
  nvd · libgphoto2 · debian · bookworm; nvd · libgphoto2 · debian · 12
- 2.5.30-1 · all · bookworm
  Affected
  nvd · libgphoto2 · debian · bookworm; nvd · libgphoto2 · debian · 12
[libgphoto2-port12]Affected
Source package: [libgphoto2]
Details (2)
- 2.5.30-1 · amd64 · bookworm
  Affected
  nvd · libgphoto2 · debian · bookworm; nvd · libgphoto2 · debian · 12
- 2.5.30-1 · arm64 · bookworm
  Affected
  nvd · libgphoto2 · debian · bookworm; nvd · libgphoto2 · debian · 12

[Debian 13 (Trixie)]

[libgphoto2-6t64]Affected
Source package: [libgphoto2]
Details (2)
- 2.5.31-4 · amd64 · trixie
  Affected
  nvd · libgphoto2 · debian · 13
- 2.5.31-4 · arm64 · trixie
  Affected
  nvd · libgphoto2 · debian · 13
[libgphoto2-dev]Affected
Source package: [libgphoto2]
Details (2)
- 2.5.31-4 · amd64 · trixie
  Affected
  nvd · libgphoto2 · debian · 13
- 2.5.31-4 · arm64 · trixie
  Affected
  nvd · libgphoto2 · debian · 13
[libgphoto2-dev-doc]Affected
Source package: [libgphoto2]
Details (2)
- 2.5.31-4 · all · trixie
  Affected
  nvd · libgphoto2 · debian · 13
- 2.5.31-4 · all · trixie
  Affected
  nvd · libgphoto2 · debian · 13
[libgphoto2-l10n]Affected
Source package: [libgphoto2]
Details (2)
- 2.5.31-4 · all · trixie
  Affected
  nvd · libgphoto2 · debian · 13
- 2.5.31-4 · all · trixie
  Affected
  nvd · libgphoto2 · debian · 13
[libgphoto2-port12t64]Affected
Source package: [libgphoto2]
Details (2)
- 2.5.31-4 · amd64 · trixie
  Affected
  nvd · libgphoto2 · debian · 13
- 2.5.31-4 · arm64 · trixie
  Affected
  nvd · libgphoto2 · debian · 13

Observed: Oct 23, 2026, 10:32:48 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]