---
id: "CVE-2026-120452"
kind: "vulnerability"
aliases: ["CVE-2026-120452"]
title: "libgphoto2: malicious USB camera thumbnail corrupts memory and leaks heap"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["digital-cameras", "libgphoto2", "linux", "package", "usb"]
not_affected_if: ["libgphoto2-not-installed", "no-usb-camera-access"]
published_at: "2026-11-02T15:17:28+00:00"
first_seen_at: "2026-11-02T15:24:03+00:00"
updated_at: "2026-11-02T15:26:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120452", "first_seen_at": "2026-11-02T15:24:03+00:00"}]
---

# libgphoto2: malicious USB camera thumbnail corrupts memory and leaks heap

libgphoto2 up to 2.5.34 has a heap out-of-bounds read and write in the jl2005bcd_decompress() routine. A malicious USB camera can send crafted thumbnail data that writes about 30 KB past a buffer and leaks heap contents in preview images.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Find the installed version with `pkg-config --modversion libgphoto2` and check whether it is `2.5.34` or earlier.
- Check whether applications that use libgphoto2 (for example gphoto2 or photo management tools) are installed on machines that connect USB cameras.

## Fix

- A patch is linked from the sources; the fixed version is not stated.

## Timeline

- 2026-11-02T15:24:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120452

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/libgphoto2-through-2.5.34-heap-out-of-bounds-read-write-via-jl2005c-thumbnail-conversion
- [fix] Patch: github.com https://github.com/gphoto/libgphoto2/commit/30bf7ace6d47cfe1232ea73bde2aceb95aba4bfb
- [fix] Patch: github.com https://github.com/gphoto/libgphoto2/commit/af3b8e9c542cda863fb5f2f3cfeb261bd78e4442

## From the sources

libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd_decompress() that allows malicious USB cameras to corrupt heap memory via oversized thumbnail processing. Attackers can supply small allocation-table values and a thumbnail header byte so in-place byte-swapping exceeds the buffer by about 30 KB, leaking heap contents in preview images.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_