Libexif EUVD-2026-12345

Exploitation requires the victim application to process attacker-controlled image files containing EXIF MakerNote metadata through libexif versions 0.6.25 or earlier. The vulnerable code path is triggered specifically when exif_mnote_data_get_value is invoked on MakerNote entries with zero-size parameters, which is not the default parsing behavior for well-formed images - the attacker must craft malformed EXIF structures with intentionally invalid size fields. High attack complexity (AC:H) indicates exploitation success depends on precise knowledge of target application memory layout, heap state during parsing, or race conditions that make memory corruption outcomes predictable and exploitable. The local attack vector (AV:L) means the attacker must deliver the malicious image through local file system access, email attachments, messaging apps, web uploads to vulnerable servers, or social engineering to induce file opening. While no privileges are required (PR:N) at the OS level, practical exploitation is limited to contexts where the attacker controls image file inputs and the target application automatically or user-interactively parses EXIF data without sandboxing. Applications that strip or ignore MakerNote tags, or that use alternative EXIF parsers, are not vulnerable through this specific code path.

CVSS 7.4 HIGH rating reflects maximum technical impact (C:H/I:H/A:H), but real-world exploitability is constrained by local attack vector (AV:L) and high complexity (AC:H). EPSS score of 0.01% (2nd percentile) indicates minimal observed exploitation activity in the wild, aligning with the absence of CISA KEV listing. The AC:H metric suggests successful exploitation requires precise race conditions, memory layout knowledge, or specific application contexts where attacker-controlled image files are processed with predictable memory states. SSVC decision factors: Exploitation=POC (upstream commit exists but no weaponized exploit confirmed), Automatable=No (local vector requires file placement/user interaction in most scenarios), Technical Impact=Total (arbitrary code execution possible). Primary risk exists in automated server-side image processing pipelines that handle untrusted uploads without sandboxing, or desktop applications where users open malicious images from untrusted sources. The PR:N (no privileges required) aspect is misleading - while no OS-level authentication is needed, the attacker must control image file inputs, which constitutes an implicit access requirement. Overall assessment: Medium-priority remediation for internet-facing image processors, lower priority for isolated desktop deployments. The low EPSS score despite 7.4 CVSS suggests this is a defense-in-depth concern rather than an imminent mass-exploitation threat.

An attacker crafts a JPEG image file containing malicious MakerNote EXIF metadata with a size field set to zero, designed to trigger the integer underflow when parsed by libexif. The victim opens this image in a vulnerable photo management application or uploads it to a web service using libexif for thumbnail generation. During EXIF parsing, exif_mnote_data_get_value performs buffer operations with the underflowed size value, overwriting adjacent heap memory with attacker-controlled data from the MakerNote payload. The attacker leverages this memory corruption to overwrite function pointers or control structures, achieving arbitrary code execution in the context of the image processing application. Publicly available upstream commit 7df372e exists showing the vulnerable code path, lowering the barrier for exploit development.