The vulnerability in libgphoto2 (<= 2.5.33) involves an out-of-bounds read in the ptp_unpack_Sony_DPD() function within camlibs/ptp2/ptp-pack.c. Specifically, the function reads a 2-byte enumeration count via dtoh16o(data, *poffset) without checking if 2 bytes remain in the buffer, unlike the standard ptp_unpack_DPD() function which includes this check. This leads to a potential out-of-bounds read condition classified as CWE-125. The issue was corrected in a later commit that added the missing boundary check.

This vulnerability allows an attacker to cause an out-of-bounds read, which can lead to information disclosure (confidentiality impact) and potentially cause a denial of service (availability impact). The CVSS 3.1 score is 5.2 (medium severity), reflecting that the attack vector requires physical access (AV:P) and no privileges or user interaction are needed. There is no indication of known exploits in the wild.

A fix for this vulnerability is available in the codebase as indicated by commit 3b9f9696be76ae51dca983d9dd8ce586a2561845. Users should upgrade libgphoto2 to a version later than 2.5.33 that includes this fix. Since no official vendor advisory or patch link is provided, users should verify the fix in the upstream repository or wait for an official release containing this commit. Patch status is not yet confirmed via vendor advisory; check the vendor or project repository for current remediation guidance.