libgphoto2, a camera access and control library, contains an out-of-bounds read vulnerability (CWE-125) in the ptp_unpack_OI() function located in camlibs/ptp2/ptp-pack.c. The function validates that the length parameter is less than 48 but subsequently reads memory offsets 48 to 56, up to 9 bytes beyond the validated boundary, due to a Samsung Galaxy 64-bit object size detection heuristic. This can cause reading of unintended memory areas. The issue affects versions up to and including 2.5.33 and is addressed by commit 7c7f515bc88c3d0c4098ac965d313518e0ccbe33.

The vulnerability allows an out-of-bounds read which can lead to unauthorized disclosure of memory contents, impacting confidentiality. The CVSS vector indicates no required privileges or user interaction, but the attack vector is physical (AV:P). The impact includes high confidentiality and availability impact but no integrity impact. There are no known exploits in the wild at this time.

A fix for this vulnerability is available in the form of commit 7c7f515bc88c3d0c4098ac965d313518e0ccbe33. Users should upgrade libgphoto2 to a version that includes this commit or later. Since no official vendor advisory or patch link is provided, verify the fix status with the libgphoto2 project repository or maintainers. Patch status is not yet confirmed via a vendor advisory; check the vendor's resources for current remediation guidance.