The libgphoto2 camera access and control library versions up to 2.5.33 have an out-of-bounds read vulnerability in the ptp_unpack_DPV() function located in camlibs/ptp2/ptp-pack.c. Specifically, the UINT128 and INT128 cases increment the offset by 16 bytes without ensuring that 16 bytes are available, as the initial check only guarantees at least one byte is available. This can lead to reading up to 15 bytes beyond the buffer boundary. The vulnerability is fixed by commit 433bde9888d70aa726e32744cd751d7dbe94379a.

An out-of-bounds read can lead to information disclosure by reading memory beyond the intended buffer. According to the CVSS vector, the vulnerability requires physical access (AV:P), has low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and impacts confidentiality with high severity (C:H), but does not affect integrity (I:N) and only has low impact on availability (A:L). No known exploits are reported in the wild.

A fix is available via commit 433bde9888d70aa726e32744cd751d7dbe94379a. Users should upgrade libgphoto2 to a version later than 2.5.33 where this issue is patched. The affected versions include multiple Ubuntu package versions up to 2.5.33-1ubuntu1. Applying the official patch or upgrading to a fixed version is recommended to remediate this vulnerability.