CVE-2026-40386
Integer Underflow in libexif MakerNote Decoding Causes Crash, Data Leak
Publication date: 2026-04-12
Last updated on: 2026-04-14
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| libexif_project | libexif | to 0.6.25 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-191 | The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an integer underflow in the libexif library (version through 0.6.25) that occurs during size checking when decoding Fuji and Olympus MakerNote data. Specifically, the issue arises in the Olympus maker note data handling code where an unsigned integer underflow happens due to improper bounds checking of an index value. This underflow can lead to incorrect comparisons, which attackers can exploit to cause the program using libexif to crash or leak information.
How can this vulnerability impact me? :
The vulnerability can impact you by causing applications that use the libexif library to crash unexpectedly or leak sensitive information. This can lead to denial of service or unintended disclosure of data, potentially compromising the stability and security of software that processes Fuji and Olympus MakerNote metadata.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is related to an integer underflow in the libexif library's handling of Olympus MakerNote data, which can cause crashes or information leaks in programs using libexif.
Detection would involve identifying if your system or applications use a vulnerable version of libexif (through 0.6.25) and if they process Fuji or Olympus MakerNote data.
There are no specific commands provided in the available resources to detect exploitation attempts or presence of the vulnerability on your network or system.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the libexif library to a version that includes the fix for CVE-2026-40386.
The fix involves correcting the bounds checking in the Olympus maker note data handling code to prevent unsigned integer underflow, as implemented in the commit referenced.
If updating immediately is not possible, avoid processing Fuji or Olympus MakerNote data with vulnerable versions of libexif to reduce risk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in libexif could potentially lead to information leakage due to an integer underflow in size checking during MakerNote decoding. Such information leaks might impact compliance with data protection regulations like GDPR or HIPAA if sensitive personal or health information is exposed through affected libexif-using programs.
However, the provided information does not explicitly describe the nature or sensitivity of the leaked data, nor does it directly link the vulnerability to specific compliance violations.