AZL-112523: CVE-2026-120452 affecting package libgphoto2 2.5.31-1
libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcddecompress() that allows malicious USB cameras to corrupt heap memory via oversized thumbnail processing. Attackers can supply small allocation-table values and a thumbnail header byte so in-place byte-swapping exceeds the buffer by about 30 KB, leaking heap contents in preview images.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using libgphoto2 through version 2.5.34 are exposed when they process thumbnails from a malicious USB camera. The affected Azure Linux package is identified as azure-linux/libgphoto2.
What does an attacker need to exploit it?
An attacker needs to provide a malicious USB camera whose thumbnail data uses small allocation-table values and a crafted thumbnail header byte. Exploitation occurs during processing in jl2005bcd_decompress().
What is the potential impact of successful exploitation?
The flaw permits heap out-of-bounds reads and writes by roughly 30 KB during in-place byte swapping. This can corrupt heap memory and leak heap contents in preview images.