CVE-2026-120452: libgphoto2 through 2.5.34 Heap Out-of-Bounds Read/Write via jl2005c Thumbnail Conversion

Published Nov 2, 2026

Updated

libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcddecompress() that allows malicious USB cameras to corrupt heap memory via oversized thumbnail processing. Attackers can supply small allocation-table values and a thumbnail header byte so in-place byte-swapping exceeds the buffer by about 30 KB, leaking heap contents in preview images.

Affected Software

8 affected components

ubuntu/libgphoto2*

Event History

Nov 2, 2026

CVE Published

via OSV·02:29 PM

Data Sourced

via OSV·02:29 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Nov 3, 2026

Data Sourced

via OSV·12:00 AM

Affected Software

Frequently Asked Questions

Which systems are exposed to this issue?

Systems using libgphoto2 through 2.5.34 that process thumbnails from JL2005C-compatible USB cameras are exposed. Exploitation requires interaction with a malicious USB camera rather than a network-only attack path.

What must an attacker control to trigger the memory corruption?

An attacker needs to provide a malicious USB camera that supplies small allocation-table values and a crafted thumbnail header byte. Those values cause in-place byte swapping in jl2005bcd_decompress() to run beyond the allocated heap buffer.

What impact is described if exploitation succeeds?

The flaw can corrupt heap memory through an out-of-bounds read and write of roughly 30 KB. It can also leak heap contents into generated preview images.

How can I determine whether I may be affected?

Check whether the installed libgphoto2 version is 2.5.34 or earlier and whether it is used to import or generate previews from USB cameras using the affected JL2005C thumbnail conversion path.

CVE-2026-120452: libgphoto2 through 2.5.34 Heap Out-of-Bounds Read/Write via jl2005c Thumbnail Conversion

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What must an attacker control to trigger the memory corruption?

What impact is described if exploitation succeeds?

How can I determine whether I may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What must an attacker control to trigger the memory corruption?

What impact is described if exploitation succeeds?

How can I determine whether I may be affected?