PT-2026-25617 · Libexif · Libexif

Breakingbad6 · Published 2026-01-01 · Updated 2026-05-12 · CVE-2026-32775

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libexif versions through 0.6.25

Description The software contains a flaw in decoding MakerNotes. Specifically, an integer underflow occurs within the exif mnote data get value function when it receives a size of 0, leading to a buffer overwrite.

Recommendations Update to a version of libexif newer than 0.6.25.

Fix

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

CVE-2026-32775

OESA-2026-1678

OPENSUSE-SU-2026:10717-1

Affected Products

Libexif

References · 21

• https://github.com/libexif/libexif/commit/7df372e9d31d7c993a22b913c813a5f7ec4f3692 · Patch
• https://github.com/libexif/libexif/issues/247 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-32775 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2026-32775 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-32775 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10717-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1678 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-32775 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32775 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32775 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-32775 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32775 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-32775 · Security Note
• https://suse.com/security/cve/CVE-2026-40386 · Note
• https://t.me/msrcreports/3428 · Telegram Post