CVE-2026-40385: Integer Overflow in libexif

The Integer Overflow vulnerability in libexif arises from insufficient validation within the Nikon MakerNote handling routines. An attacker could craft a malicious EXIF file containing a specially crafted Nikon MakerNote that triggers an overflow when processed by libexif. This overflow can lead to a denial-of-service (DoS) condition, causing the application using libexif to crash. More concerningly, depending on the application's memory layout and privilege level, the overflow could potentially be exploited to leak sensitive information from memory. The vulnerability's impact is limited to 32-bit systems, as the overflow condition is more easily exploitable in this architecture.

1. Reserved2026-04-12
2. Published2026-04-12
3. Modified2026-04-14
4. EPSS updated2026-04-20

The primary mitigation for CVE-2026-40385 is to upgrade to libexif version 0.6.26 or later, which contains the fix for the Integer Overflow. If upgrading is not immediately feasible, consider implementing input validation on EXIF files before processing them with libexif. Specifically, scrutinize the size and format of Nikon MakerNotes to prevent oversized or malformed data from being passed to the vulnerable function. While a WAF is unlikely to be effective here, a proxy could potentially be configured to inspect EXIF data for suspicious patterns. After upgrading, confirm the fix by attempting to process a known malicious EXIF file (if available) and verifying that it no longer triggers a crash or information leak.