CVE-2026-40335 is an out-of-bounds read vulnerability in libgphoto2 (up to version 2.5.33) specifically in the ptp_unpack_DPV() function located in camlibs/ptp2/ptp-pack.c. The vulnerability arises because the function increments the offset by 16 bytes for UINT128 and INT128 data types without verifying that 16 bytes remain in the input buffer, only checking that at least one byte is available. This can lead to reading beyond the buffer boundary, potentially exposing sensitive memory contents. The issue is patched in commit 433bde9888d70aa726e32744cd751d7dbe94379a. The CVSS 3.1 base score is 5.2, reflecting a medium severity with a network attack vector requiring low complexity and no privileges or user interaction. The confidentiality impact is high, while integrity is unaffected and availability impact is low.

The vulnerability allows an attacker with local access to cause an out-of-bounds read, potentially exposing sensitive information from memory. There is no indication of integrity compromise or significant availability disruption. No known exploits are reported in the wild, reducing immediate risk. The medium CVSS score reflects moderate risk primarily due to confidentiality impact.

A patch fixing this vulnerability has been committed (commit 433bde9888d70aa726e32744cd751d7dbe94379a). However, no official vendor advisory or release containing the fix is referenced in the provided data. Users should upgrade libgphoto2 to a version including this commit or later once officially released. Until then, monitor vendor channels for an official patch. No other mitigations or workarounds are specified.