libgphoto2, a camera access and control library, contains an out-of-bounds read vulnerability in versions up to 2.5.33 within the ptp_unpack_Sony_DPD() function in camlibs/ptp2/ptp-pack.c. The function reads the FormFlag byte without validating that the read is within the bounds of the data buffer, unlike the standard ptp_unpack_DPD() function which performs this check. This flaw can cause the application to read memory beyond the allocated buffer, potentially leading to information disclosure or application instability. The issue was corrected in commit 09f8a940b1e418b5693f5c11e3016a1ad2cea62d. The CVSS 3.1 base score is 5.2, reflecting a medium severity with network attack vector requiring no privileges or user interaction, impacting confidentiality and availability.

The vulnerability allows an out-of-bounds read which can lead to partial disclosure of memory contents or cause application crashes, impacting confidentiality and availability. The CVSS score of 5.2 indicates a medium severity impact. There are no reports of exploitation in the wild. The attack vector is local (physical or logical access to the device running libgphoto2), and no privileges or user interaction are required.

A fix for this vulnerability exists as a source code commit (09f8a940b1e418b5693f5c11e3016a1ad2cea62d) that adds the missing bounds check. However, no official patch release or vendor advisory has been provided to confirm patch availability. Users should monitor the official libgphoto2 project for updated releases containing this fix and apply them promptly. Until then, avoid processing untrusted Sony camera data with vulnerable versions of libgphoto2 to reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.