Live › vulnerability › CVE-2026-120452
libgphoto2 up to 2.5.34 has a heap out-of-bounds read and write in the jl2005bcd_decompress() routine. A malicious USB camera can send crafted thumbnail data that writes about 30 KB past a buffer and leaks heap contents in preview images.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Systems that run libgphoto2 2.5.34 or earlier and talk to USB cameras are exposed, since the bad data comes from the camera itself. Machines without libgphoto2 or without camera access can skip it. The sources do not say which downstream applications bundle the affected code.
No product ranges from the sources yet.
pkg-config --modversion libgphoto2 and check whether it is 2.5.34 or earlier.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd_decompress() that allows malicious USB cameras to corrupt heap memory via oversized thumbnail processing. Attackers can supply small allocation-table values and a thumbnail header byte so in-place byte-swapping exceeds the buffer by about 30 KB, leaking heap contents in preview images.
This page as .md · .json · in your agent: get_signal("CVE-2026-120452")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.