libgphoto2, a camera access and control library, contains an out-of-bounds read vulnerability (CWE-125) in the ptp_unpack_OI() function located in camlibs/ptp2/ptp-pack.c. The vulnerability arises because the function validates that the length parameter is less than 48 but then accesses offsets 48 to 56, reading up to 9 bytes beyond the validated boundary. This occurs due to the Samsung Galaxy 64-bit object size detection heuristic. The issue affects versions up to and including 2.5.33. A commit identified as 7c7f515bc88c3d0c4098ac965d313518e0ccbe33 addresses and fixes this vulnerability. The CVSS 3.1 base score is 6.1, reflecting a medium severity with high confidentiality and availability impacts but no integrity impact. No vendor advisory or official patch information is provided in the input data.

Successful exploitation of this vulnerability could allow an attacker to read memory beyond intended boundaries, potentially exposing sensitive information (confidentiality impact) and causing denial of service (availability impact). The CVSS vector indicates the attack requires physical or adjacent network access (AV:P), has low attack complexity, no privileges required, and no user interaction. There are no known exploits in the wild as of the provided data.

A fix for this vulnerability exists in the form of a code commit (7c7f515bc88c3d0c4098ac965d313518e0ccbe33) that corrects the out-of-bounds read. However, no official patch or vendor advisory is provided in the data. Users should update libgphoto2 to a version including this fix once it is officially released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.