CVE-2026-120452EPSS p8.1%

CVE-2026-120452CVE-2026-120452

Description

libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd_decompress() that allows malicious USB cameras to corrupt heap memory via oversized thumbnail processing. Attackers can supply small allocation-table values and a thumbnail header byte so in-place byte-swapping exceeds the buffer by about 30 KB, leaking heap contents in preview images.

Scoring

CVSS 5.4 ()
VectorCVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
EPSS0.18% probability of exploitation · percentile 8.1% · 2026-11-03T12:00:27Z
Last modified2026-11-02
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.