Libexif CVE-2026-32775

Upgrade to libexif version newer than 0.6.25 once the maintainers release a tagged version incorporating commit 7df372e9d31d7c993a22b913c813a5f7ec4f3692, which addresses the integer underflow in exif_mnote_data_get_value. The upstream fix is available at https://github.com/libexif/libexif/commit/7df372e9d31d7c993a22b913c813a5f7ec4f3692 and can be backported by Linux distributions or compiled from the main branch for immediate remediation in critical environments. Until official releases propagate through distribution channels, implement compensating controls: configure image processing applications to reject files with MakerNote tags if business logic permits (trade-off: loss of camera-specific metadata), deploy mandatory access control policies (SELinux/AppArmor) to sandbox image parsing processes with no-new-privs and restricted filesystem access (trade-off: operational complexity and potential breakage of legitimate write operations), or preprocess uploads through a separate validation service that strips EXIF data entirely using an alternative parser like exiftool or ImageMagick's identify with resource limits (trade-off: metadata loss and added latency). For server-side deployments, container isolation with minimal capabilities and read-only root filesystems mitigates post-exploitation impact but does not prevent the initial memory corruption. Monitor vendor advisories at the GitHub repository for official patch release announcements.