{"id":"CVE-2026-32775","aliases":["ALPINE-CVE-2026-32775","AZL-79862","BELL-CVE-2026-32775","CLSA-2026-1776768816","CLSA-2026-1776769506","CLSA-2026-1776791358","CLSA-2026-1787305055","CLSA-2026-1792990909","DEBIAN-CVE-2026-32775","EUVD-2026-12345","GHSA-pq8m-942f-68cv","JLSEC-2026-150","MGASA-2026-0112","OESA-2026-1678","ROOT-OS-DEBIAN-11-CVE-2026-32775","ROOT-OS-DEBIAN-12-CVE-2026-32775","ROOT-OS-DEBIAN-13-CVE-2026-32775","SUSE-SU-2026:22324-1","SUSE-SU-2026:2837-1","SUSE-SU-2026:2838-1","UBUNTU-CVE-2026-32775","USN-8531-1","openSUSE-SU-2026:10717-1","openSUSE-SU-2026:21023-1"],"status":"published","title":"libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value...","description":"libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0022,"percentile":0.12631,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-191"],"published":"2026-03-16T06:31:36Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"libexif","fixed_in":["0.6.26-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libexif","fixed_in":["0.6.24-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"libexif","fixed_in":["0.6.25-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libexif","fixed_in":["0.6.25-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libexif","fixed_in":["0.6.24-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libexif","fixed_in":["0.6.25-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libexif","fixed_in":["0.6.26-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"libexif_jll","fixed_in":["0.6.26+0"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"libexif","fixed_in":["0.6.21-27.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"libexif","fixed_in":["0.6.22-6.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"libexif","fixed_in":["0.6.24-2.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"libexif","fixed_in":["0.6.24-2.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"libexif","fixed_in":["0.6.24-2.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"libexif","fixed_in":["0.6.24-2.oe2403sp3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libexif","fixed_in":["0.6.24-1ubuntu0.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libexif","fixed_in":["0.6.24-1ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libexif","fixed_in":["0.6.25-2ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.26-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.24-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.6.25-r0"},{"fixed":"0.6.25-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.6.24-r2"},{"fixed":"0.6.25-r1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.22-6.el9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libexif-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.22-6.el9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libexif-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.22-6.el9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.22-6.el9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libexif-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.22-6.el9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libexif-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.22-6.el9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.22-2.el7_9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libexif-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.22-2.el7_9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libexif-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.22-2.el7_9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libexif-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.21-4ubuntu0.6+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libexif-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.21-4ubuntu0.6+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libexif12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.21-4ubuntu0.6+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.22-2.el7_9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"libexif-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.22-2.el7_9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"libexif-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.22-2.el7_9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.24-1+deb12u1"}]}],"versions":["0.6.24-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.25-1+deb13u1"}]}],"versions":["0.6.25-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.26-1"}]}],"versions":["0.6.25-1","0.6.25-2"]},{"source":"osv","ecosystem":"Julia","package":"libexif_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.6.26+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.26-1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.21-27.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.22-6.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.24-2.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.24-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.24-2.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.24-2.oe2403sp3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.26-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.26-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.22-150000.5.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.22-150000.5.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.22-8.16.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.21-1","0.6.21-1ubuntu1","0.6.21-1ubuntu1+esm1","0.6.21-1ubuntu1+esm2","0.6.21-1ubuntu1+esm5","0.6.21-1ubuntu1+esm6"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.21-2","0.6.21-2ubuntu0.1","0.6.21-2ubuntu0.2","0.6.21-2ubuntu0.5","0.6.21-2ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.21-2.1","0.6.21-4","0.6.21-4ubuntu0.1","0.6.21-4ubuntu0.2","0.6.21-4ubuntu0.5","0.6.21-4ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.21-5.1","0.6.21-6","0.6.21-6ubuntu0.1","0.6.21-6ubuntu0.3","0.6.21-6ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.24-1ubuntu0.22.04.1"}]}],"versions":["0.6.22-3","0.6.22-3build1","0.6.23-1","0.6.24-1","0.6.24-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.24-1ubuntu0.24.04.1"}]}],"versions":["0.6.24-1build1","0.6.24-1build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.25-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.25-2ubuntu0.1"}]}],"versions":["0.6.25-1","0.6.25-1build1","0.6.25-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.24-1ubuntu0.22.04.1"}]}],"versions":["0.6.22-3","0.6.22-3build1","0.6.23-1","0.6.24-1","0.6.24-1build1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.24-1ubuntu0.24.04.1"}]}],"versions":["0.6.24-1build1","0.6.24-1build2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.25-2ubuntu0.1"}]}],"versions":["0.6.25-1","0.6.25-1build1","0.6.25-2"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.26-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libexif","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.26-160000.1.1"}]}],"bundled":3}],"products":[{"vendor":"libexif project","product":"libexif"},{"vendor":"libexif_project","product":"libexif"}],"references":[{"url":"https://github.com/libexif/libexif/commit/7df372e9d31d7c993a22b913c813a5f7ec4f3692","tags":["Patch","fix","web"]},{"url":"https://github.com/libexif/libexif/issues/247","tags":["Exploit","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32775","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-pq8m-942f-68cv"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-32775","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-32775","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1776768816.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1776769506.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1776791358.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787305055.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40385","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40386","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1792990909.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32775.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-32775","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0112.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35368","tags":["report"]},{"url":"http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2026\u0026m=slackware-security.368011","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1678","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622324-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259755","tags":["report"]},{"url":"https://bugzilla.suse.com/1262000","tags":["report"]},{"url":"https://bugzilla.suse.com/1262001","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40386","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262837-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262838-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-32775","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32775","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8531-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-40385","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-40386","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-32775","description":"libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow.","status":"published","published":"2026-03-16T06:31:36.015Z","modified":"2026-04-12T18:23:28.578Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-191"],"updated_at":"2026-11-02T14:19:57.47301Z"}],"euvd":[{"id":"EUVD-2026-12345","description":"libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow.","status":"published","published":"2026-03-16T06:31:36Z","modified":"2026-04-12T18:23:28Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:24:29.371024Z"}],"ghsa":[{"id":"GHSA-pq8m-942f-68cv","title":"libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value...","description":"libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow.","status":"published","published":"2026-03-16T15:30:43Z","modified":"2026-03-16T15:30:55Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-191"],"updated_at":"2026-11-02T15:06:38.778049Z"}],"nvd":[{"id":"CVE-2026-32775","description":"libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow.","status":"published","published":"2026-03-16T14:19:44.413Z","modified":"2026-06-17T10:36:21.81Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-191"],"updated_at":"2026-11-02T14:12:09.358914Z"}],"osv":[{"id":"ALPINE-CVE-2026-32775","description":"libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow.","status":"published","published":"2026-03-16T14:19:44.413Z","modified":"2026-11-03T06:32:54.033322766Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"BELL-CVE-2026-32775","status":"published","published":"2026-03-17T06:08:50.876952Z","modified":"2026-04-25T07:21:17.748848Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.572955Z"},{"id":"CVE-2026-32775","description":"libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow.","status":"published","published":"2026-03-16T06:31:36.015Z","modified":"2026-10-28T10:49:26.534797327Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-191"],"updated_at":"2026-11-02T15:45:01.548715Z"},{"id":"DEBIAN-CVE-2026-32775","description":"libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow.","status":"published","published":"2026-03-16T14:19:44.413Z","modified":"2026-10-01T03:02:37.172892472Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.232518Z"},{"id":"JLSEC-2026-150","description":"libexif through 0.6.25 has a flaw in decoding MakerNotes. If the `exif_mnote_data_get_value` function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow.","status":"published","published":"2026-04-17T15:47:23.992Z","modified":"2026-07-25T18:23:56.711669309Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2026-1678","title":"libexif security update","description":"Most digital cameras produce EXIF files, which are JPEG files with extra tags that contain information about the image. The EXIF library allows you to parse an EXIF file and read the data from those tags.\r\n\r\nSecurity Fix(es):\n\nlibexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow.(CVE-2026-32775)","status":"published","published":"2026-03-20T11:10:42Z","modified":"2026-08-18T01:19:41.055708092Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-32775","title":"CVE-2026-32775 in libexif - Patched by Root","description":"Root has patched CVE-2026-32775 in the libexif package for Root:Debian:11. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-20T13:38:32Z","modified":"2026-10-09T13:00:09.21604519Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:29.900552Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-32775","title":"CVE-2026-32775 in rootio-libexif - Patched by Root","description":"Root has patched CVE-2026-32775 in the rootio-libexif package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-05-12T09:30:12Z","modified":"2026-08-27T14:00:07.762674571Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:32.037361Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-32775","title":"CVE-2026-32775 in rootio-libexif - Patched by Root","description":"Root has patched CVE-2026-32775 in the rootio-libexif package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-03-19T16:11:01Z","modified":"2026-08-27T14:00:04.395666169Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:33.415244Z"},{"id":"UBUNTU-CVE-2026-32775","description":"libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow.","status":"published","published":"2026-03-16T14:19:00Z","modified":"2026-07-13T20:30:07.061526362Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"AZL-79862","title":"CVE-2026-32775 affecting package libexif for versions less than 0.6.24-2","description":"libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow.","status":"published","published":"2026-03-16T14:19:44Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"CLSA-2026-1776768816","title":"libexif: Fix of 3 CVEs","description":"- CVE-2026-32775: fix buffer overwrite via integer underflow in MakerNote\n  entry value handling\n- CVE-2026-40385: fix unsigned 32-bit integer overflow in Nikon MakerNote\n  handling\n- CVE-2026-40386: fix integer underflow in Fuji/Olympus MakerNote size\n  checks","status":"published","published":"2026-04-21T10:53:41Z","modified":"2026-06-01T00:32:24.65725173Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1776769506","title":"libexif: Fix of 3 CVEs","description":"- CVE-2026-32775: fix buffer overwrite via integer underflow in MakerNote\n  entry value handling\n- CVE-2026-40385: fix unsigned 32-bit integer overflow in Nikon MakerNote\n  handling\n- CVE-2026-40386: fix integer underflow in Fuji/Olympus MakerNote size\n  checks","status":"published","published":"2026-04-21T11:05:11Z","modified":"2026-06-01T00:32:47.487722719Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1776791358","title":"libexif: Fix of 3 CVEs","description":"- CVE-2026-32775: fix buffer overwrite via integer underflow in MakerNote\n  entry value handling\n- CVE-2026-40385: fix unsigned 32-bit integer overflow in Nikon MakerNote\n  handling\n- CVE-2026-40386: fix integer underflow in Fuji/Olympus MakerNote size\n  checks","status":"published","published":"2026-04-21T17:09:24Z","modified":"2026-06-01T00:33:09.906297524Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1787305055","title":"Fix CVE(s): CVE-2026-32775, CVE-2026-40385, CVE-2026-40386","description":"   * SECURITY UPDATE: out-of-bounds write in MakerNote value formatting\n     - debian/patches/CVE-2026-32775.patch: reject maxlen == 0 before the\n       maxlen-- underflow in mnote_canon_entry_get_value(),\n       mnote_fuji_entry_get_value(), mnote_olympus_entry_get_value() and\n       mnote_pentax_entry_get_value().\n     - CVE-2026-32775\n   * SECURITY UPDATE: integer overflow when reading Nikon MakerNotes\n     - debian/patches/CVE-2026-40385.patch: bound the offset read from the\n       MakerNote before adding it to datao in\n       exif_mnote_data_olympus_load(), which could wrap on 32-bit size_t\n       and lead to out-of-bounds reads.\n     - CVE-2026-40385\n   * SECURITY UPDATE: unsigned integer underflow in MakerNote tag lookup\n     - debian/patches/CVE-2026-40386.patch: use \"i \u003e= n-\u003ecount\" instead of\n       \"i \u003e n-\u003ecount - 1\" in exif_mnote_data_fuji_get_value() and\n       exif_mnote_data_olympus_get_value(), which underflowed when count\n       was 0.\n     - CVE-2026-40386","status":"published","published":"2026-08-21T09:37:47Z","modified":"2026-10-26T09:31:47.557842542Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1792990909","title":"libexif: Fix of 3 CVEs","description":"- CVE-2026-32775: fix buffer overwrite via integer underflow in MakerNote\n  entry value handling\n- CVE-2026-40385: fix unsigned 32-bit integer overflow in Nikon MakerNote\n  handling\n- CVE-2026-40386: fix integer underflow in Fuji/Olympus MakerNote size\n  checks","status":"published","published":"2026-10-26T05:02:02Z","modified":"2026-10-26T09:31:57.223636298Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"MGASA-2026-0112","title":"Updated libexif packages fix security vulnerabilities","description":"CVE-2026-32775: libexif through 0.6.25 has a flaw in decoding\nMakerNotes. If the exif_mnote_data_get_value function gets passed in a 0\nsize, the passed in-buffer would be overwritten due to an integer\nunderflow.\nCVE-2026-40385: In libexif through 0.6.25, an unsigned 32bit integer\noverflow in Nikon MakerNote handling could be used by local attackers to\ncause crashes or information leaks. This only affects 32bit systems.\nCVE-2026-40386: In libexif through 0.6.25, an integer underflow in size\nchecking for Fuji and Olympus MakerNote decoding could be used by\nattackers to crash or leak information out of libexif-using programs.\n","status":"published","published":"2026-05-07T05:06:13Z","modified":"2026-05-07T05:15:39.239151Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10717-1","title":"libexif-devel-0.6.26-1.1 on GA media","description":"These are all security issues fixed in the libexif-devel-0.6.26-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-07T00:00:00Z","modified":"2026-05-08T08:16:16.272006Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:21023-1","title":"Security update for libexif","description":"This update for libexif fixes the following issues\n\n- CVE-2026-32775: Buffer overwrite via integer underflow in MakerNotes decoding (bsc#1259755).\n- CVE-2026-40385: information disclosure and crashes via integer overflow in Nikon MakerNote handling (bsc#1262000).\n- CVE-2026-40386: denial of service and information disclosure via integer underflow in MakerNote decoding\n  (bsc#1262001).\n","status":"published","published":"2026-06-22T14:30:37Z","modified":"2026-06-30T18:24:37.106448832Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22324-1","title":"Security update for libexif","description":"This update for libexif fixes the following issues\n\n- CVE-2026-32775: Buffer overwrite via integer underflow in MakerNotes decoding (bsc#1259755).\n- CVE-2026-40385: information disclosure and crashes via integer overflow in Nikon MakerNote handling (bsc#1262000).\n- CVE-2026-40386: denial of service and information disclosure via integer underflow in MakerNote decoding\n  (bsc#1262001).\n","status":"published","published":"2026-06-22T14:27:22Z","modified":"2026-07-02T18:24:11.013087789Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2837-1","title":"Security update for libexif","description":"This update for libexif fixes the following issues\n\n- CVE-2026-40385: Fixed information disclosure and crashes via integer overflow in Nikon MakerNote \n  handling (bsc#1262000)\n- CVE-2026-40386: Fixed denial of service and information disclosure via integer underflow in MakerNote \n  decoding (bsc#1262001)\n- CVE-2026-32775: Fixed Buffer overwrite via integer underflow in MakerNotes decoding (bsc#1259755)\n","status":"published","published":"2026-07-10T08:01:49Z","modified":"2026-07-11T09:15:06.22278865Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:2838-1","title":"Security update for libexif","description":"This update for libexif fixes the following issues\n\n- CVE-2026-40385: Fixed information disclosure and crashes via integer overflow in Nikon MakerNote \n  handling (bsc#1262000)\n- CVE-2026-40386: Fixed denial of service and information disclosure via integer underflow in MakerNote \n  decoding (bsc#1262001)\n- CVE-2026-32775: Fixed Buffer overwrite via integer underflow in MakerNotes decoding (bsc#1259755)\n","status":"published","published":"2026-07-10T08:02:27Z","modified":"2026-07-11T09:15:06.177585716Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8531-1","title":"libexif vulnerabilities","description":"It was discovered that libexif had an integer overflow in its MakerNote\ndecoder when called with a zero-length buffer. An attacker could possibly\nuse this issue to cause a denial of service or obtain sensitive\ninformation. (CVE-2026-32775)\n\nIt was discovered that libexif had an integer overflow in its Nikon\nMakerNote handler on 32-bit systems. A local attacker could possibly use\nthis issue to cause a denial of service or obtain sensitive information.\n(CVE-2026-40385)\n\nIt was discovered that libexif had an integer underflow in its size\nchecking for Fuji and Olympus MakerNote decoding. An attacker could\npossibly use this issue to cause a denial of service or obtain sensitive\ninformation. (CVE-2026-40386)","status":"published","published":"2026-07-13T12:15:07Z","modified":"2026-07-13T20:44:41.789481778Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}