Executive brief
libexif is a widely used library for parsing metadata (EXIF data) from digital images. A flaw in how it handles specific image formats from Fuji and Olympus cameras could allow an attacker to crash applications using the library or potentially access sensitive information from the computer's memory. This could impact any software that processes user-uploaded images, such as photo viewers or web services.
Technical details
An integer underflow vulnerability (CWE-191) exists in libexif's Fuji and Olympus MakerNote decoding logic, specifically within the size checking routines in exif-mnote-data-fuji.c and exif-mnote-data-olympus.c. The flaw occurs when calculating bounds for tag queries (e.g., using 'i > n->count - 1' when count is 0), leading to an underflow. A local attacker can exploit this by providing a specially crafted image file to a program utilizing libexif. Successful exploitation can result in an out-of-bounds read, causing a process crash (DoS) or the leakage of sensitive memory contents. A patch has been committed to the libexif GitHub repository to correct the bounds checking logic.
Affected products
- libexif project libexif up to and including 0.6.25
Timeline
- 2026-04-12: disclosed: CVE-2026-40386 published
- 2026-04-14: advisory: NIST/NVD analysis completed
- 2026-04-12: patched: Fix committed to libexif repository