Threats affecting pkg:github/libgphoto2

libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd_decompress() that allows malicious USB cameras to corrupt heap memory via oversized thumbnail processing. Attackers can supply small allocation-table values and a thumbnail header byte so in-place byte-swapping exceeds the buffer by about 30 KB, leaking heap contents in preview images.

CVE-2026-120451 is a high-severity vulnerability in libgphoto2 up to version 2.5.34. It involves stack-based and heap-based buffer overflows in the jl2005c_init() function caused by malicious USB devices supplying an unbounded allocation table entry count. This can lead to memory corruption, including overwriting the saved return address and heap data, potentially allowing code execution.