PT-2026-32181 · Libexif+1 · Libexif+1

Kerwin · CVE-2026-40386 · Published 2026-04-02 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions libexif versions through 0.6.25

Description An integer underflow in size checking during the decoding of Fuji and Olympus MakerNote data within libexif could allow attackers to cause a crash or leak information from programs that use libexif.

Recommendations Update to a version of libexif newer than 0.6.25.

Exploit

Fix

DoS

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

ALSA-2026:20929

ALSA-2026:22529

ALSA-2026:22553

BDU:2026-05545

CVE-2026-40386

JLSEC-2026-152

OESA-2026-1987

OPENSUSE-SU-2026:10717-1

OPENSUSE-SU-2026:21023-1

RHSA-2026:20929

RHSA-2026:22529

RHSA-2026:26274

SUSE-SU-2026:22324-1

SUSE-SU-2026:2837-1

SUSE-SU-2026:2838-1

USN-8531-1

Affected Products

Rocky Linux

Libexif

References · 54

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40386.json · Exploit
• https://github.com/libexif/libexif/commit/dc6eac6e9655d14d0779d99e82d0f5f442d2f34b · Patch
• https://osv.dev/vulnerability/SUSE-SU-2026:2838-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40386 · Security Note
• https://osv.dev/vulnerability/JLSEC-2026-152 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40386 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:20929 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8531-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-20929.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-40386 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40386 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1987 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-40386 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40385 · Security Note
• https://errata.almalinux.org/10/ALSA-2026-22529.html · Vendor Advisory