Red Hat CVE-2026-40333

Patch to the commit 1817ecead20c2aafa7549dac9619fe38f47b2f53 or later, which adds length validation to the affected functions. Most Linux distributions should provide updated packages of libgphoto2 version 2.5.34 or later; check your distribution's package repositories. For applications bundling libgphoto2, rebuild against the patched library. Until patching is possible, mitigate by disabling automatic camera detection and limiting connections to trusted, known-good camera models via configuration whitelists, though this is cumbersome. Another compensating control is to run camera access tools in a sandboxed environment (container, VM, or AppArmor/SELinux profile) with read-only access to sensitive data, limiting the information disclosure impact. For systems where camera access is not required, uninstall libgphoto2 or disable the PTP2 camera support module. See GitHub security advisory GHSA-hq94-cp6h-3gjp and upstream commit 1817ecead20c2aafa7549dac9619fe38f47b2f53 for implementation details.