Hi,

The following vulnerabilities were published for libgphoto2, both in the
Jeilin JL2005B/C/D camlib (camlibs/jl2005c), which Debian builds and ships
(jl2005c.so in libgphoto2-6t64).

CVE-2026-120451: jl2005c_init() takes the allocation table entry count from
the device without an upper bound and reads/copies the table into the
0x4020 byte stack buffer info[] and into priv->table[0x4000]; a count of
1022 or more overflows both.

CVE-2026-120452: jl2005bcd_decompress() takes the thumbnail size from a
device header byte and byte-swaps that many samples in place without
checking the input length (heap out-of-bounds read and write).

Upstream issue: gphoto/libgphoto2 #1326
Upstream fix: pull request #1338, merged as af3b8e9c542c, consisting of
6a3393dd9965 jl2005c: reject an allocation table that does not fit the
buffers (CVE-2026-120451)
30bf7ace6d47 jl2005c: bound thumbnail conversion by the real input length
(CVE-2026-120452)
Neither is in a release yet (the latest upstream release is 2.5.34).

I checked the Debian sources: both commits apply with patch -p1 (clean on
2.5.34-2; 6a3393dd9965 with offset -1 on 2.5.31-4, 2.5.30-1 and 2.5.27-1),
and a reverse dry-run confirms none of these versions contains the fix.
Both bugs need a malicious or spoofed camera on USB. I did not test with a
device or a reproducer.

If you fix this in unstable, please make sure to reference the CVE ids in
the changelog.

Regards,
Sumit Verma