Skip to main content

Libexif EUVDEUVD-2026-21734

| CVE-2026-40386 MEDIUM
Integer Underflow (CWE-191)
2026-04-12 mitre GHSA-p6wp-hhx9-7jj5
Denial Of Service Integer Overflow Red Hat Libexif Suse Libexif Project
4.0
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Attacker crafts malformed EXIF image
  2. Delivery
    User opens image in libexif application
  3. Exploit
    MakerNote parser processes Fuji/Olympus record
  4. Execution
    Integer underflow in size check
  5. Persist
    Heap buffer read/write
  6. Impact
    Memory leak or application crash

Vulnerability Assessment

Weakness
CWE
CWE-191
ASVS 5.0
V15 - Secure Coding and Architecture Integer underflow checks
Impact

CVSS 4.0 reflects low-to-moderate baseline severity: local-only attack vector (AV:L), high complexity (AC:H), and limited impact (confidentiality and availability, no integrity). EPSS exploitation probability is not provided, but the presence of a confirmed upstream fix (commit dc6eac6e) and the requirement for high complexity and local access reduce real-world urgency relative to the CVSS score. However, libexif is a widely-used dependency in image processing workflows (GIMP, ImageMagick, gPhoto2); any application that parses untrusted EXIF data from user-supplied images inherits this risk. The lack of confirmed public exploit code and absence of CISA KEV status indicate this is not actively exploited in the wild, making it a lower-priority patch for most endpoints but requiring attention in security-hardened or air-gapped image processing pipelines.
Exploit ScenarioDerived

An attacker crafts a JPEG image with a malformed Fuji or Olympus MakerNote section containing an intentionally undersized length field. When a vulnerable libexif-based application (e.g., GIMP, gPhoto2) opens the image, the parser fails to validate the size correctly, reading or writing beyond allocated heap memory. This triggers a crash (denial of service) or leaks sensitive data from the application's memory space. High complexity mitigates risk somewhat-the attacker must carefully craft the image structure and timing to exploit the underflow.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 12, 2026

Integer underflow in libexif version 0.6.25 and earlier during Fuji and Olympus MakerNote decoding allows local attackers to crash applications or leak sensitive memory information. The vulnerability requires local access and specific user interaction (high complexity) but affects all applications linking libexif, creating a supply-chain exposure for image processing tools.

RemediationAI

Upgrade libexif to a version incorporating the upstream fix at commit dc6eac6e9655d14d0779d99e82d0f5f442d2f34b or later. Review the libexif release notes and GitHub repository (https://github.com/libexif/libexif) to confirm the exact patched version number, as the provided reference is a commit hash rather than a tagged release. Applications dependent on libexif should update their library dependencies and rebuild to incorporate the fix. Pending patched releases, apply strict input validation to reject EXIF data from untrusted sources or disable MakerNote parsing if not required for core functionality.

Affected VersionsENISA

libexif 0 ≤0.6.25

Affected Packages

euvd libexif no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libexif is a C library for parsing and manipulating EXIF metadata embedded in JPEG images. MakerNote fields are manufacturer-specific extensions that may contain proprietary camera settings and thumbnails. The integer underflow (CWE-191) occurs in size-validation logic when processing Fuji and Olympus MakerNote records-a signed or unsigned integer wraps around due to insufficient bounds checking, permitting out-of-bounds heap reads or writes. Affected versions include all libexif releases through 0.6.25; the vulnerability resides in the MakerNote parser module that handles variable-length binary data without robust overflow protection.

Know when Libexif gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 4.0 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
SUSE 7.1 HIGH
AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Red Hat 4.0 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
Low

Lifecycle Timeline

2
Patch released
Apr 19, 2026 - 08:30 nvd
Patch available
CVE Published
Apr 12, 2026 - 18:19 nvd
MEDIUM 4.0

DescriptionCVE.org

In libexif through 0.6.25, an integer underflow in size checking for Fuji and Olympus MakerNote decoding could be used by attackers to crash or leak information out of libexif-using programs.

Threat Intelligence Overview

EPSS Score
0.0%
Top 98% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation
None
System Exposure· derived
Small
Automatable
No
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

20
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +20
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Libexif

View all
CVE-2017-7544 CRITICAL POC
9.1 Sep 21

libexif through 0.6.21 is vulnerable to out-of-bounds heap read vulnerability in exif_data_save_data_entry function in l
CVE-2020-13112 CRITICAL
9.1 May 21

An issue was discovered in libexif before 0.6.22. Rated critical severity (CVSS 9.1), this vulnerability is remotely exp
CVE-2012-2841 HIGH
7.5 Jul 13

Integer underflow in the exif_entry_get_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) 0.6
CVE-2012-2814 HIGH
7.5 Jul 13

Buffer overflow in the exif_entry_format_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) 0.
CVE-2020-13113 HIGH
8.2 May 21

An issue was discovered in libexif before 0.6.22. Rated high severity (CVSS 8.2), this vulnerability is remotely exploit
CVE-2012-2840 HIGH
7.5 Jul 13

Off-by-one error in the exif_convert_utf16_to_utf8 function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif
CVE-2020-0198 HIGH
7.5 Jun 11

In exif_data_load_data_content of exif-data.c, there is a possible UBSAN abort due to an integer overflow. Rated high se
CVE-2020-0181 HIGH
7.5 Jun 11

In exif_data_load_data_thumbnail of exif-data.c, there is a possible denial of service due to an integer overflow. Rated
CVE-2020-13114 HIGH
7.5 May 21

An issue was discovered in libexif before 0.6.22. Rated high severity (CVSS 7.5), this vulnerability is remotely exploit
CVE-2026-32775 HIGH
7.4 Mar 16

Integer underflow in libexif 0.6.25 and earlier allows local attackers to overwrite memory via crafted MakerNote EXIF da
CVE-2012-2836 MEDIUM
6.4 Jul 13

The exif_data_load_data function in exif-data.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remot
CVE-2012-2812 MEDIUM
6.4 Jul 13

The exif_entry_get_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows rem

Same weakness CWE-191 – Integer Underflow

View all
CVE-2014-0497 CRITICAL POC
9.8
CVE-2015-5212 MEDIUM
6.8
CVE-2017-14496 HIGH POC
7.5
CVE-2014-8768 MEDIUM POC
5.0
CVE-2017-11757 CRITICAL POC
9.8
CVE-2024-23313 CRITICAL POC
9.8
CVE-2021-3323 CRITICAL POC
9.8
CVE-2021-21811 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-40386 ADVISORY https://ubuntu.com/security/notices/USN-8531-1 ADVISORY https://vuldb.com/vuln/357043 REF https://github.com/libexif/libexif/commit/dc6eac6e9655d14d0779d99e82d0f5f442d2f34b

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy