libgphoto2, a camera access and control library, contains a vulnerability (CVE-2026-40334) in versions up to 2.5.33 where the ptp_unpack_Canon_FE() function copies a filename into a 13-byte buffer using strncpy without explicitly null-terminating the buffer. If the source filename is exactly 13 bytes without a null terminator, the buffer remains unterminated, causing out-of-bounds reads in subsequent string operations. This is classified as CWE-170 (Improper Null Termination). The issue is fixed by commit 259fc7d3bfe534ce4b114c464f55b448670ab873. The CVSS v3.1 base score is 3.5, indicating low severity, with the vector showing the attack requires physical access (AV:P), low complexity, no privileges or user interaction, and impacts confidentiality and availability slightly.

The vulnerability can cause out-of-bounds reads when processing certain filenames, potentially leading to information disclosure or application instability. The impact is limited to confidentiality and availability with low severity. There are no reports of exploitation in the wild. The vulnerability requires physical access to the device using libgphoto2 and does not allow privilege escalation or code execution.

A fix for this vulnerability has been committed in libgphoto2 (commit 259fc7d3bfe534ce4b114c464f55b448670ab873). Users should upgrade to a version of libgphoto2 that includes this patch. Since the vendor advisory or patch links are not explicitly provided, users should verify the patch availability in the official libgphoto2 repository or releases. No additional mitigations are indicated.