libexif up to 0.6.25 MakerNotes Decoder exif_mnote_data_get_value integer underflow

Summaryinfo

A vulnerability identified as problematic has been detected in libexif up to 0.6.25. Impacted is the function exif_mnote_data_get_value of the component MakerNotes Decoder. Performing a manipulation results in integer underflow. This vulnerability was named CVE-2026-32775. The attack needs to be approached locally. There is no available exploit.

Detailsinfo

A vulnerability was found in libexif up to 0.6.25. It has been classified as problematic. This affects the function exif_mnote_data_get_value of the component MakerNotes Decoder. The manipulation with an unknown input leads to a integer underflow vulnerability. CWE is classifying the issue as CWE-191. The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-32775 since 03/16/2026. The exploitability is told to be difficult. An attack has to be approached locally. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 302513 (Linux Distros Unpatched Vulnerability : CVE-2026-32775), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (302513) and EUVD (EUVD-2026-12345). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• libexif

Version

• 0.6.0
• 0.6.1
• 0.6.2
• 0.6.3
• 0.6.4
• 0.6.5
• 0.6.6
• 0.6.7
• 0.6.8
• 0.6.9
• 0.6.10
• 0.6.11
• 0.6.12
• 0.6.13
• 0.6.14
• 0.6.15
• 0.6.16
• 0.6.17
• 0.6.18
• 0.6.19
• 0.6.20
• 0.6.21
• 0.6.22
• 0.6.23
• 0.6.24
• 0.6.25

Website

• Product: https://github.com/libexif/libexif/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion