{"id":"CVE-2026-120452","kind":"vulnerability","aliases":["CVE-2026-120452"],"related":[],"title":"libgphoto2: malicious USB camera thumbnail corrupts memory and leaks heap","description":"libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd_decompress() that allows malicious USB cameras to corrupt heap memory via oversized thumbnail processing. Attackers can supply small allocation-table values and a thumbnail header byte so in-place byte-swapping exceeds the buffer by about 30 KB, leaking heap contents in preview images.","summary":"libgphoto2 up to 2.5.34 has a heap out-of-bounds read and write in the jl2005bcd_decompress() routine. A malicious USB camera can send crafted thumbnail data that writes about 30 KB past a buffer and leaks heap contents in preview images.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["digital-cameras","libgphoto2","linux","package","usb"],"not_affected_if":["libgphoto2-not-installed","no-usb-camera-access"],"how_to_check":"- Find the installed version with `pkg-config --modversion libgphoto2` and check whether it is `2.5.34` or earlier.\n- Check whether applications that use libgphoto2 (for example gphoto2 or photo management tools) are installed on machines that connect USB cameras.","fix":"- A patch is linked from the sources; the fixed version is not stated.","status":"open","published_at":"2026-11-02T15:17:28+00:00","first_seen_at":"2026-11-02T15:24:03+00:00","triaged_at":"2026-11-02T15:26:30+00:00","updated_at":"2026-11-02T15:26:30+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-02T15:26:30Z","model":"claude-haiku-5-5","output":{"fix":"- A patch is linked from the sources; the fixed version is not stated.","reach":"local","title":"libgphoto2: malicious USB camera thumbnail corrupts memory and leaks heap","impact":"medium","summary":"libgphoto2 up to 2.5.34 has a heap out-of-bounds read and write in the jl2005bcd_decompress() routine. A malicious USB camera can send crafted thumbnail data that writes about 30 KB past a buffer and leaks heap contents in preview images.","audience":"developers","category":"package","nicknames":[],"who_cares":["libgphoto2","usb","digital-cameras","linux"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Heap memory is corrupted and contents leak in preview images.","analyst_note":"","how_to_check":"- Find the installed version with `pkg-config --modversion libgphoto2` and check whether it is `2.5.34` or earlier.\n- Check whether applications that use libgphoto2 (for example gphoto2 or photo management tools) are installed on machines that connect USB cameras.","plain_action":"","needs_analyst":false,"not_affected_if":["no-usb-camera-access","libgphoto2-not-installed"],"who_is_affected":"Systems that run libgphoto2 2.5.34 or earlier and talk to USB cameras are exposed, since the bad data comes from the camera itself. Machines without libgphoto2 or without camera access can skip it. The sources do not say which downstream applications bundle the affected code.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.001157,"input_tokens":4227,"output_tokens":1468,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120452':13A,16A '-2026':12A,15A '2.5.34':27B,69C '30':55B,122C 'alloc':102C 'allocation-t':101C 'allow':85C 'attack':97C 'bound':34B,76C 'buffer':59B,119C 'byte':109C,115C 'byte-swap':114C 'camera':4A,19B,46B,88C 'contain':70C 'content':63B,126C 'corrupt':6A,90C 'craft':49B 'cve':11A,14A 'data':51B 'decompress':41B,83C 'digit':18B 'digital-camera':17B 'exceed':117C 'header':108C 'heap':10A,30B,62B,72C,91C,125C 'imag':66B,129C 'in-plac':111C 'jl2005bcd':40B,82C 'kb':56B,123C 'leak':9A,61B,124C 'libgphoto2':1A,20B,24B,67C 'linux':21B 'malici':2A,44B,86C 'memori':7A,92C 'out-of-bound':31B,73C 'overs':94C 'packag':22B 'past':57B 'place':113C 'preview':65B,128C 'process':96C 'read':35B,77C 'routin':42B 'send':48B 'small':100C 'suppli':99C 'swap':116C 'tabl':103C 'thumbnail':5A,50B,95C,107C 'usb':3A,23B,45B,87C 'valu':104C 'via':93C 'vulner':80C 'write':37B,53B,79C","nicknames":[],"mitigations":[],"who_affected":"Systems that run libgphoto2 2.5.34 or earlier and talk to USB cameras are exposed, since the bad data comes from the camera itself. Machines without libgphoto2 or without camera access can skip it. The sources do not say which downstream applications bundle the affected code.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["digitalcameras","libgphoto2","linux","medium","package","usb"],"first_public_at":"2026-11-02T15:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120452","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120452","severity":null,"published_at":"2026-11-02T15:17:28+00:00","modified_at":"2026-11-02T15:17:28+00:00","first_seen_at":"2026-11-02T15:24:03+00:00","fetched_at":"2026-11-02T15:24:03+00:00","note":null}],"documents":[{"id":52500,"url":"https://github.com/gphoto/libgphoto2/commit/30bf7ace6d47cfe1232ea73bde2aceb95aba4bfb","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":52496,"url":"https://github.com/gphoto/libgphoto2/commit/af3b8e9c542cda863fb5f2f3cfeb261bd78e4442","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":52502,"url":"https://www.vulncheck.com/advisories/libgphoto2-through-2.5.34-heap-out-of-bounds-read-write-via-jl2005c-thumbnail-conversion","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}