The libgphoto2 library suffers from out-of-bounds memory reads caused by two unpacking functions that accept a data pointer but omit a length parameter. Because callers provide no explicit size check, the functions read beyond the allocated buffer, potentially exposing arbitrary data from the process’s memory space. This flaw corresponds to CWE‑125 and CWE‑130 and can lead to disclosure of confidential information if exploited.

gphoto's libgphoto2 library releases up to and including version 2.5.33 are vulnerable. The library is widely used for camera access and control, meaning that any application that links against these builds or compiles them into a binary is at risk if it processes data from a PTP‑compliant camera.

The CVSS base score of 6.1 classifies the issue as moderate severity. The EPSS score of < 1% indicates that the likelihood of public exploitation is very low, and the flaw is not listed in CISA KEV. Based on the description, it is inferred that the attack vector is local or device‑centric: an attacker must be able to supply crafted PTP packets to the library, such as through a malicious camera firmware, a compromised camera, or a network conduit that can inject data at the transport layer. With the missing size validation, any malformed payload could read beyond buffer boundaries and leak memory contents to the running process.