The vulnerability in libgphoto2 arises from out-of-bounds memory reads caused by missing length parameters in two unpacking functions. The functions ptp_unpack_EOS_ImageFormat() and ptp_unpack_EOS_CustomFuncEx() in camlibs/ptp2/ptp-pack.c read data without validating the buffer size, leading to a potential disclosure of arbitrary data in user memory. This flaw corresponds to CWE‑125, indicating an unchecked read beyond a buffer boundary.

Affected releases include libgphoto2 versions up to and including 2.5.33. The library is widely used for camera access and control, meaning any system that compiles or links against these versions could be vulnerable if it processes data from an EOS camera or utilizes the PTP protocol during event handling.

The CVSS base score of 6.1 classifies the issue as moderate severity, and the absence of an EPSS score indicates limited publicly known exploitation data. The flaw is not listed in the CISA KEV catalog, suggesting it is not a widely exploited vulnerability. Exploitation would require an attacker able to supply crafted PTP packets to the library, such as through a compromised camera device or a manufacturing environment that can inject data at the transport layer. While the attack vector appears local or device‑centric, the lack of input length checks makes the read boundary validation impossible within the library, so any corrupted payload could leak memory contents to the running process.