PT-2026-32180 · Libexif+3 · Libexif+3

Kerwin · CVE-2026-40385 · Published 2026-04-12 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions libexif versions through 0.6.25

Description A flaw exists in libexif that involves an unsigned 32bit integer overflow when handling Nikon MakerNote data. This issue can lead to crashes or information leaks. The issue is limited to 32bit systems.

Recommendations Update to a version of libexif newer than 0.6.25.

Exploit

Fix

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALSA-2026:20929

ALSA-2026:22553

BDU:2026-10464

CVE-2026-40385

JLSEC-2026-151

OESA-2026-1987

OPENSUSE-SU-2026:10717-1

OPENSUSE-SU-2026:21023-1

RHSA-2026:20929

RHSA-2026:22553

RHSA-2026:26190

RHSA-2026:26191

RHSA-2026:26192

RHSA-2026:26224

RHSA-2026:26276

RHSA-2026:26292

RHSA-2026:26567

SUSE-SU-2026:22324-1

SUSE-SU-2026:2837-1

SUSE-SU-2026:2838-1

USN-8531-1

Affected Products

Linuxmint

Red Os

Rocky Linux

Libexif

References · 54

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40385.json · Exploit
• https://github.com/libexif/libexif/commit/93003b93e50b3d259bd2227d8775b73a53c35d58 · Patch
• https://osv.dev/vulnerability/CVE-2026-40385 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:20929 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1987 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-40385 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21023-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:2837-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:20929 · Vendor Advisory
• https://osv.dev/vulnerability/JLSEC-2026-151 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40385 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-10464 · Security Note
• https://ubuntu.com/security/CVE-2026-32775 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:22553 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40385 · Security Note