libgphoto2 is a camera access and control library
The libgphoto2 library has a bug where it doesn't properly null-terminate a filename, which can lead to out-of-bounds reads. This happens when the filename is exactly 13 bytes long and doesn't have a null terminator. This can cause issues when the library tries to access the filename later.
libgphoto2 is a camera access and control library. In versions up to and including 2.5.33, a missing null terminator exists in ptp_unpack_Canon_FE() in camlibs/ptp2/ptp-pack.c (line 1377). The function copies a filename into a 13-byte buffer using strncpy without explicitly null-terminating the result. If the source data is exactly 13 bytes with no null terminator, the buffer is left unterminated, leading to out-of-bounds reads in any subsequent string operation. Commit 259fc7d3bfe534ce4b114c464f55b448670ab873 patches the issue.
Developers using libgphoto2 to access cameras are at risk of out-of-bounds reads, which can lead to crashes or data corruption, although the risk is relatively low due to the physical attack vector.
Monitor & Review
Low severity — keep this CVE on your radar and patch during routine maintenance.
What should I do?
Published
CVE disclosed publicly
Last Modified
Most recent update
Indexed to CVEInsight
Added to this platform
AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
0
Affected Products
2
References
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Exploitability
Impact