libgphoto2, a camera access and control library, contains an out-of-bounds read vulnerability in the ptp_unpack_DPV() function within camlibs/ptp2/ptp-pack.c. Specifically, when handling UINT128 and INT128 data types, the function increments the buffer offset by 16 bytes without confirming that 16 bytes are available, only checking that at least 1 byte remains. This leads to reading up to 15 bytes beyond the buffer boundary. The vulnerability affects versions up to 2.5.33 and is fixed by commit 433bde9888d70aa726e32744cd751d7dbe94379a. The CVSS 3.1 base score is 5.2, indicating medium severity, with an attack vector requiring physical access and no privileges or user interaction needed.

The out-of-bounds read can cause disclosure of memory contents beyond the intended buffer, potentially leaking sensitive information. The vulnerability does not allow code execution or integrity modification but may impact confidentiality. The attack requires physical access to the device using libgphoto2. There are no known exploits in the wild at this time.

A fix for this vulnerability is available in libgphoto2 via commit 433bde9888d70aa726e32744cd751d7dbe94379a. Users and administrators should upgrade to a version of libgphoto2 that includes this patch. Since the vendor advisory or patch links are not explicitly provided, verify the patch availability from the official gphoto project repository or releases. Patch status is not yet confirmed in the provided data; check the vendor advisory for current remediation guidance.