libgphoto2, a camera access and control library, contains a memory leak in versions up to 2.5.33 within the ptp_unpack_Sony_DPD() function located in camlibs/ptp2/ptp-pack.c. When handling a secondary enumeration list introduced by 2024+ Sony cameras, the function calls calloc() to allocate memory for dpd->FORM.Enum.SupportedValue without freeing the previously allocated memory, resulting in a leak of the original array and any contained strings on every property descriptor parse. The issue is tracked as CWE-401 (Missing Release of Memory after Effective Lifetime). The vulnerability has a CVSS 3.1 base score of 2.4, reflecting low severity and limited impact. A commit identified by hash 404ff02c75f3cb280196fc260a63c4d26cf1a8f6 fixes the problem, although no official patch release or vendor advisory is provided in the data.

The vulnerability causes a memory leak that can lead to resource exhaustion if the affected function is invoked repeatedly, potentially degrading application availability. There is no impact on confidentiality or integrity. No known exploits are reported in the wild.

A code fix has been committed to address the memory leak. However, no official patch release or vendor advisory is currently available. Users should monitor the libgphoto2 project for an official update that includes this fix and apply it once released. Until then, be aware of the potential for increased memory usage when processing affected Sony camera data. Patch status is not yet confirmed—check the vendor advisory or project repository for current remediation guidance.