UBUNTU-CVE-2026-120451: Buffer Overflow
libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005cinit() that allow malicious USB devices to corrupt memory by supplying an unbounded allocation table entry count. Attackers can connect a spoofed Jeilin JL2005B/C/D camera reporting 1022 or more entries to overwrite the saved return address and heap data, potentially achieving code execution.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using libgphoto2 that communicate with a Jeilin JL2005B, JL2005C, or JL2005D camera are exposed if a malicious USB device can be connected. Exploitation requires a spoofed device that identifies as one of these cameras.
What does an attacker need to do to exploit it?
The attacker needs physical or equivalent access to connect a malicious USB device. The device must supply an allocation table entry count of 1022 or more while libgphoto2 processes it.
How severe could successful exploitation be?
The malformed entry count can overwrite a saved return address and heap data through stack-based and heap-based buffer overflows. This may allow memory corruption and potentially code execution.