CVE-2026-120451
Received Received - Intake

Heap-based Buffer Overflow in libgphoto2

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulnCheck

Description
libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005c_init() that allow malicious USB devices to corrupt memory by supplying an unbounded allocation table entry count. Attackers can connect a spoofed Jeilin JL2005B/C/D camera reporting 1022 or more entries to overwrite the saved return address and heap data, potentially achieving code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120451

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gPhoto libgphoto2 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves libgphoto2 versions up to 2.5.34, which has stack-based and heap-based buffer overflow issues in the jl2005c_init() function. Malicious USB devices can exploit this by providing an unbounded allocation table entry count, leading to memory corruption. Specifically, spoofed Jeilin JL2005B/C/D cameras reporting 1022 or more entries can overwrite return addresses and heap data, potentially allowing code execution.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable versions of libgphoto2. Use commands like 'dpkg -l | grep libgphoto2' on Debian-based systems or 'rpm -qa | grep libgphoto2' on RPM-based systems to identify installed versions. If the version is 2.5.34 or earlier, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary code on your system by connecting a malicious USB device. This may lead to unauthorized access, data theft, or system compromise. Users of affected libgphoto2 versions should update to a patched version immediately.

Compliance Impact

This vulnerability primarily affects data integrity and system reliability by allowing memory corruption through malicious USB devices. While it does not directly violate GDPR or HIPAA, it could indirectly impact compliance by enabling unauthorized code execution or data corruption on systems handling sensitive data. Organizations processing personal or health data must ensure such vulnerabilities are patched to maintain secure environments required by these regulations.

Mitigation Strategies

Immediately update libgphoto2 to version 2.5.35 or later. Disable USB device auto-mounting if not required. Restrict physical access to USB ports to prevent malicious device connections. Monitor system logs for unusual activity related to USB devices.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120451. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...