libgphoto2 through 2.5.34 Heap Out-of-Bounds Read/Write via jl2005c Thumbnail Conversion

Advisories

libgphoto2 through 2.5.34 Heap Out-of-Bounds Read/Write via jl2005c Thumbnail Conversion

Severity: medium
Date: 11/2/2026
Affecting: libgphoto2 <= 2.5.34
CVE: CVE-2026-120452
CWE: CWE-787 Out-of-bounds Write
CVSS: 5.2
CVSS V4 Vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
References: https://github.com/gphoto/libgphoto2/issues/1326
https://github.com/gphoto/libgphoto2/commit/af3b8e9c542cda863fb5f2f3cfeb261bd78e4442
https://github.com/gphoto/libgphoto2/commit/30bf7ace6d47cfe1232ea73bde2aceb95aba4bfb
https://github.com/gphoto/libgphoto2/blob/v2.5.34/camlibs/jl2005c/jl2005bcd_decompress.c#L127-L130
https://hackmd.io/@haindpwn/libgphoto2-jl2005c-init-alloc-table-buffer-overflow
Credit: HaiND from the Post and Telecommunication Institute of Technology, TheProtagonist07
Description: libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd_decompress() that allows malicious USB cameras to corrupt heap memory via oversized thumbnail processing. Attackers can supply small allocation-table values and a thumbnail header byte so in-place byte-swapping exceeds the buffer by about 30 KB, leaking heap contents in preview images.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo