libgphoto2 is a camera access and control library.
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (lines 884–885). When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd->FORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation from line 857. The original array and any string values it contains are leaked on every property descriptor parse. Commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the issue.
AI Analysis
Technical Summary
libgphoto2, a camera access and control library, contains a memory leak in the ptp_unpack_Sony_DPD() function located in camlibs/ptp2/ptp-pack.c (lines 884–885). The vulnerability affects versions up to and including 2.5.33. When processing the secondary enumeration list introduced in 2024+ Sony cameras, the function overwrites dpd->FORM.Enum.SupportedValue with a new calloc() allocation without freeing the previously allocated memory from line 857. This results in a memory leak of the original array and any contained string values on every property descriptor parse. The issue is resolved by commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6.
Potential Impact
The vulnerability causes a memory leak, which can lead to increased memory usage and potential denial of service due to resource exhaustion. There is no impact on confidentiality, integrity, or availability beyond the memory leak. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix is available as indicated by the referenced commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6. Users should upgrade libgphoto2 to a version that includes this fix. Specific patched package versions are not provided in the input; therefore, users should consult the Ubuntu security advisories or libgphoto2 upstream sources for updated versions beyond 2.5.33.
libgphoto2 is a camera access and control library.
Description
libgphoto2 is a camera access and control library. Versions up to and including 2.5.33 have a memory leak in `ptp_unpack_Sony_DPD()` in `camlibs/ptp2/ptp-pack.c` (lines 884–885). When processing a secondary enumeration list (introduced in 2024+ Sony cameras), the function overwrites dpd->FORM.Enum.SupportedValue with a new calloc() without freeing the previous allocation from line 857. The original array and any string values it contains are leaked on every property descriptor parse. Commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the issue.
CVSS v3.1
Score 2.4low
Affected software
pkg:deb/ubuntu/[email protected]?arch=source&distro=questingpkg:deb/ubuntu/[email protected]?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
libgphoto2, a camera access and control library, contains a memory leak in the ptp_unpack_Sony_DPD() function located in camlibs/ptp2/ptp-pack.c (lines 884–885). The vulnerability affects versions up to and including 2.5.33. When processing the secondary enumeration list introduced in 2024+ Sony cameras, the function overwrites dpd->FORM.Enum.SupportedValue with a new calloc() allocation without freeing the previously allocated memory from line 857. This results in a memory leak of the original array and any contained string values on every property descriptor parse. The issue is resolved by commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6.
Potential Impact
The vulnerability causes a memory leak, which can lead to increased memory usage and potential denial of service due to resource exhaustion. There is no impact on confidentiality, integrity, or availability beyond the memory leak. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix is available as indicated by the referenced commit 404ff02c75f3cb280196fc260a63c4d26cf1a8f6. Users should upgrade libgphoto2 to a version that includes this fix. Specific patched package versions are not provided in the input; therefore, users should consult the Ubuntu security advisories or libgphoto2 upstream sources for updated versions beyond 2.5.33.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-40336
- Osv Schema Version
- 1.7.0
- Aliases
- []
- Ecosystems
- ["Ubuntu:25.10","Ubuntu:26.04:LTS"]
- Database Specific Severity
- null
- Cvss Version
- 3.1
Threat ID: 6a58b41668715ace43d68571
Added to database: 07/16/2026, 10:36:06 UTC
Last enriched: 07/16/2026, 10:57:15 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.