CVE-2026-120451 — Vulnerability intelligence
—
Published:
- CVSS
- 7
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005c_init() that allow malicious USB devices to corrupt memory by supplying an unbounded allocation table entry count. Attackers can connect a spoofed Jeilin JL2005B/C/D camera reporting 1022 or more entries to overwrite the saved return address and heap data, potentially achieving code execution.