CVE-2026-120452
Received Received - Intake

Heap Out-of-Bounds Read/Write in libgphoto2

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulnCheck

Description
libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd_decompress() that allows malicious USB cameras to corrupt heap memory via oversized thumbnail processing. Attackers can supply small allocation-table values and a thumbnail header byte so in-place byte-swapping exceeds the buffer by about 30 KB, leaking heap contents in preview images.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120452

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gPhoto libgphoto2 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

libgphoto2 through version 2.5.34 has a heap out-of-bounds read and write flaw in the jl2005bcd_decompress function. Malicious USB cameras can exploit this by sending oversized thumbnail data, causing the function to corrupt heap memory during in-place byte-swapping. Attackers manipulate allocation tables and thumbnail headers to exceed buffer limits by about 30 KB, leading to heap memory leaks visible in preview images.

Detection Guidance

This vulnerability is specific to USB cameras using libgphoto2. Detection requires checking for affected libgphoto2 versions (through 2.5.34) and monitoring for unusual memory corruption in preview images from connected cameras. No direct network detection commands are applicable.

Impact Analysis

This vulnerability allows attackers with physical access to a system via a malicious USB camera to corrupt memory, potentially causing crashes, data leaks, or arbitrary code execution. Users may experience system instability, unauthorized data exposure, or compromised applications handling image previews from affected cameras.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or memory corruption, potentially violating GDPR's data protection requirements or HIPAA's safeguards for sensitive health data. Organizations may face compliance risks if exploited, resulting in data breaches or loss of confidentiality.

Mitigation Strategies

Update libgphoto2 to the latest version beyond 2.5.34. Avoid connecting untrusted USB cameras. Disable automatic thumbnail generation for unknown devices. Monitor system logs for memory corruption errors related to libgphoto2.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120452. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...