USN-8586-1: libgphoto2 vulnerabilities

It was discovered that libgphoto2 did not properly validate buffer
boundaries when parsing EOS image format data. An attacker with physical
access could possibly use this issue to obtain sensitive information.
(CVE-2026-40333)

It was discovered that libgphoto2 did not properly null-terminate buffers
when parsing Canon folder entries. An attacker with physical access could
possibly use this issue to obtain sensitive information. (CVE-2026-40334)

It was discovered that libgphoto2 did not properly validate buffer
boundaries when parsing device property values. An attacker with physical
access could possibly use this issue to obtain sensitive information.
(CVE-2026-40335)

It was discovered that libgphoto2 had a memory leak when parsing Sony
device property descriptors. An attacker with physical access could
possibly use this issue to cause a denial of service. This issue only
affected Ubuntu 26.04 LTS. (CVE-2026-40336)

It was discovered that libgphoto2 did not properly validate buffer
boundaries when parsing Sony device property enumeration data. An attacker
with physical access could possibly use this issue to obtain sensitive
information. (CVE-2026-40338)

It was discovered that libgphoto2 did not properly validate buffer
boundaries when parsing Sony device property form flags. An attacker with
physical access could possibly use this issue to obtain sensitive
information. (CVE-2026-40339)

It was discovered that libgphoto2 did not properly validate buffer
boundaries when parsing object information. An attacker with physical
access could possibly use this issue to obtain sensitive information.
(CVE-2026-40340)

It was discovered that libgphoto2 did not properly validate buffer
boundaries when parsing EOS focus information. An attacker with physical
access could possibly use this issue to cause libgphoto2 to crash,
resulting in a denial of service. (CVE-2026-40341)