PT-2026-32180 · Libexif · Libexif

Kerwin · Published 2026-04-12 · Updated 2026-05-26 · CVE-2026-40385

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions libexif versions through 0.6.25

Description A flaw exists in libexif that involves an unsigned 32bit integer overflow when handling Nikon MakerNote data. This issue can lead to crashes or information leaks. The issue is limited to 32bit systems.

Recommendations Update to a version of libexif newer than 0.6.25.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALSA-2026:20929

CVE-2026-40385

JLSEC-2026-151

OESA-2026-1987

OPENSUSE-SU-2026:10717-1

Affected Products

Libexif

References · 27

• https://github.com/libexif/libexif/commit/93003b93e50b3d259bd2227d8775b73a53c35d58 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40385 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40385 · Vendor Advisory
• https://osv.dev/vulnerability/JLSEC-2026-151 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2026-40385 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1987 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-20929.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-40385 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-40385 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2026-20929.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:20929 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10717-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40385 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40386 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-40385 · Security Note