PT-2026-32181 · Libexif+1 · Libexif+1

Kerwin · Published 2026-04-02 · Updated 2026-06-02 · CVE-2026-40386

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions libexif versions through 0.6.25

Description An integer underflow in size checking during the decoding of Fuji and Olympus MakerNote data within libexif could allow attackers to cause a crash or leak information from programs that use libexif.

Recommendations Update to a version of libexif newer than 0.6.25.

Fix

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

ALSA-2026:20929

ALSA-2026:22553

BDU:2026-05545

CVE-2026-40386

JLSEC-2026-152

OESA-2026-1987

OPENSUSE-SU-2026:10717-1

Affected Products

Rocky Linux

Libexif

References · 33

• https://github.com/libexif/libexif/commit/dc6eac6e9655d14d0779d99e82d0f5f442d2f34b · Patch
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2026-40386 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:20929 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1987 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2026-20929.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-20929.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05545 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10717-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-40386 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-40386 · Security Note
• https://osv.dev/vulnerability/JLSEC-2026-152 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40386 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-40386 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:20929 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:22553 · Vendor Advisory