CVE-2026-40336

Public on 2026-04-18
Modified on 2026-04-21
Description
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (lines 884–885). When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd->FORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation from line 857. The original array and any string values it contains are leaked on every property descriptor parse. Commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the issue.
Severity
Low severity
Low
See what this means
CVSS v3 Base Score
2.4
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Core libgphoto2 Not Affected

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 2.4 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L