High severity · published Apr 12, 2026
CVE-2026-40385
In libexif through 0.6.25, an unsigned 32bit integer overflow in Nikon MakerNote handling could be used by local attackers to cause crashes or information leaks
7.1
CVSS
0.1%
EPSS
No
On KEV
Description
In libexif through 0.6.25, an unsigned 32bit integer overflow in Nikon MakerNote handling could be used by local attackers to cause crashes or information leaks. This only affects 32bit systems.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
libexif · libexif project
through 0.6.25 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-40385
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-40385
Patch
https://github.com/libexif/libexif/commit/93003b93e50b3d259bd2227d8775b73a53c35d58
More from libexif
9.1
CVE-2020-13112
An issue was discovered in libexif before 0.6.22
9.1
CVE-2017-7544
libexif through 0.6.21 is vulnerable to out-of-bounds heap read vulnerability in exif_data_save_data_entry function in libexif/exif-data.c caused by improper length computation of…
8.2
CVE-2020-13113
An issue was discovered in libexif before 0.6.22
8.1
CVE-2016-6328
A vulnerability was found in libexif
7.8
CVE-2026-32775
libexif through 0.6.25 has a flaw in decoding MakerNotes