Live › vulnerability › CVE-2026-120451
libgphoto2 through 2.5.34 has stack and heap buffer overflows in its jl2005c_init() routine for Jeilin JL2005B/C/D cameras. A malicious USB device reporting 1022 or more allocation table entries can overwrite the saved return address and heap data, potentially allowing code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
The flaw is in the camera driver code path of libgphoto2 and needs a USB device that presents itself as a Jeilin JL2005B/C/D camera. Systems that never connect untrusted USB devices to libgphoto2-based tools face much lower exposure. unknown whether the sources describe other camera drivers.
No product ranges from the sources yet.
gphoto2 --version or the libgphoto2 package version on the system.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005c_init() that allow malicious USB devices to corrupt memory by supplying an unbounded allocation table entry count. Attackers can connect a spoofed Jeilin JL2005B/C/D camera reporting 1022 or more entries to overwrite the saved return address and heap data, potentially achieving code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-120451")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.