{"id":"AZL-112523","summary":"CVE-2026-120452 affecting package libgphoto2 2.5.31-1","details":"libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd_decompress() that allows malicious USB cameras to corrupt heap memory via oversized thumbnail processing. Attackers can supply small allocation-table values and a thumbnail header byte so in-place byte-swapping exceeds the buffer by about 30 KB, leaking heap contents in preview images.","modified":"2026-11-04T05:34:56Z","published":"2026-11-02T15:17:28Z","upstream":["CVE-2026-120452"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120452"}],"affected":[{"package":{"name":"libgphoto2","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/libgphoto2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.5.31-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-112523.json"}}],"schema_version":"1.9.2"}