Executive brief
A vulnerability exists in libexif, a widely used library for parsing metadata in image files. On 32-bit systems, a local attacker could use a specially crafted image to cause applications using this library to crash or potentially leak sensitive information from memory. This could impact the reliability of photo-processing software and the privacy of data handled by those applications.
Technical details
An integer overflow (CWE-190) exists in the Nikon MakerNote handling logic within libexif through version 0.6.25. Specifically, the addition of offsets during the parsing of Olympus/Nikon metadata (exif-mnote-data-olympus.c) can overflow on 32-bit systems where size_t is 32 bits. A local attacker can exploit this by providing a malformed EXIF payload, leading to out-of-bounds reads. This results in a denial-of-service (crash) or the disclosure of sensitive memory contents. A patch has been committed to the libexif repository to implement overflow checking before offset calculation.
Affected products
- libexif project libexif up to and including 0.6.25
Timeline
- 2026-04-12: disclosed: CVE-2026-40385 published
- 2026-04-14: advisory: NIST initial analysis completed
- 2026-04-12: patched: Fix committed to libexif GitHub repository