CVE-2026-32775

libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow.

libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow.

libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow.

Most digital cameras produce EXIF files, which are JPEG files with extra tags that contain information about the image. The EXIF library allows you to parse an EXIF file and read the data from those tags.

Security Fix(es):

libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow.(CVE-2026-32775)

Root has patched CVE-2026-32775 in the libexif package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-32775 in the rootio-libexif package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-32775 in the rootio-libexif package for Root:Debian:13. Multiple fixed versions available.

libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow.

libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow.

• CVE-2026-32775: fix buffer overwrite via integer underflow in MakerNote entry value handling
• CVE-2026-40385: fix unsigned 32-bit integer overflow in Nikon MakerNote handling
• CVE-2026-40386: fix integer underflow in Fuji/Olympus MakerNote size checks

• CVE-2026-32775: fix buffer overwrite via integer underflow in MakerNote entry value handling
• CVE-2026-40385: fix unsigned 32-bit integer overflow in Nikon MakerNote handling
• CVE-2026-40386: fix integer underflow in Fuji/Olympus MakerNote size checks

• CVE-2026-32775: fix buffer overwrite via integer underflow in MakerNote entry value handling
• CVE-2026-40385: fix unsigned 32-bit integer overflow in Nikon MakerNote handling
• CVE-2026-40386: fix integer underflow in Fuji/Olympus MakerNote size checks

• SECURITY UPDATE: out-of-bounds write in MakerNote value formatting
  • debian/patches/CVE-2026-32775.patch: reject maxlen == 0 before the maxlen-- underflow in mnote_canon_entry_get_value(), mnote_fuji_entry_get_value(), mnote_olympus_entry_get_value() and mnote_pentax_entry_get_value().
  • CVE-2026-32775
• SECURITY UPDATE: integer overflow when reading Nikon MakerNotes
  • debian/patches/CVE-2026-40385.patch: bound the offset read from the MakerNote before adding it to datao in exif_mnote_data_olympus_load(), which could wrap on 32-bit size_t and lead to out-of-bounds reads.
  • CVE-2026-40385
• SECURITY UPDATE: unsigned integer underflow in MakerNote tag lookup
  • debian/patches/CVE-2026-40386.patch: use "i >= n->count" instead of "i > n->count - 1" in exif_mnote_data_fuji_get_value() and exif_mnote_data_olympus_get_value(), which underflowed when count was 0.
  • CVE-2026-40386

• CVE-2026-32775: fix buffer overwrite via integer underflow in MakerNote entry value handling
• CVE-2026-40385: fix unsigned 32-bit integer overflow in Nikon MakerNote handling
• CVE-2026-40386: fix integer underflow in Fuji/Olympus MakerNote size checks

CVE-2026-32775: libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow. CVE-2026-40385: In libexif through 0.6.25, an unsigned 32bit integer overflow in Nikon MakerNote handling could be used by local attackers to cause crashes or information leaks. This only affects 32bit systems. CVE-2026-40386: In libexif through 0.6.25, an integer underflow in size checking for Fuji and Olympus MakerNote decoding could be used by attackers to crash or leak information out of libexif-using programs.

These are all security issues fixed in the libexif-devel-0.6.26-1.1 package on the GA media of openSUSE Tumbleweed.

This update for libexif fixes the following issues

• CVE-2026-32775: Buffer overwrite via integer underflow in MakerNotes decoding (bsc#1259755).
• CVE-2026-40385: information disclosure and crashes via integer overflow in Nikon MakerNote handling (bsc#1262000).
• CVE-2026-40386: denial of service and information disclosure via integer underflow in MakerNote decoding (bsc#1262001).

This update for libexif fixes the following issues

• CVE-2026-32775: Buffer overwrite via integer underflow in MakerNotes decoding (bsc#1259755).
• CVE-2026-40385: information disclosure and crashes via integer overflow in Nikon MakerNote handling (bsc#1262000).
• CVE-2026-40386: denial of service and information disclosure via integer underflow in MakerNote decoding (bsc#1262001).

This update for libexif fixes the following issues

• CVE-2026-40385: Fixed information disclosure and crashes via integer overflow in Nikon MakerNote handling (bsc#1262000)
• CVE-2026-40386: Fixed denial of service and information disclosure via integer underflow in MakerNote decoding (bsc#1262001)
• CVE-2026-32775: Fixed Buffer overwrite via integer underflow in MakerNotes decoding (bsc#1259755)

This update for libexif fixes the following issues

• CVE-2026-40385: Fixed information disclosure and crashes via integer overflow in Nikon MakerNote handling (bsc#1262000)
• CVE-2026-40386: Fixed denial of service and information disclosure via integer underflow in MakerNote decoding (bsc#1262001)
• CVE-2026-32775: Fixed Buffer overwrite via integer underflow in MakerNotes decoding (bsc#1259755)

It was discovered that libexif had an integer overflow in its MakerNote decoder when called with a zero-length buffer. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2026-32775)

It was discovered that libexif had an integer overflow in its Nikon MakerNote handler on 32-bit systems. A local attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2026-40385)

It was discovered that libexif had an integer underflow in its size checking for Fuji and Olympus MakerNote decoding. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information. (CVE-2026-40386)