libgphoto2, a camera access and control library, contains an out-of-bounds read vulnerability (CWE-125) in versions up to 2.5.33. The vulnerability is in the ptp_unpack_Sony_DPD() function within camlibs/ptp2/ptp-pack.c at line 856, where a 2-byte enumeration count is read without checking if sufficient data remains in the buffer. This differs from the standard ptp_unpack_DPD() function, which includes the necessary boundary check. The issue was addressed in commit 3b9f9696be76ae51dca983d9dd8ce586a2561845. The CVSS 3.1 base score is 5.2 (medium severity), reflecting a local attack vector with low complexity and no privileges or user interaction required, impacting confidentiality and availability.

Successful exploitation could allow an attacker with local access to cause an out-of-bounds read, potentially leading to information disclosure or application instability. The vulnerability does not affect integrity and requires local access to the device. There are no known exploits in the wild at this time.

A code fix has been committed to address this vulnerability. However, there is no official patch release or vendor advisory confirming the availability of a fix. Users should monitor the official libgphoto2 project for updated releases that include this fix and apply them once available. Until then, cautious use of affected versions is advised. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.