Threats Tagged 'cve-2026-40385'

This security update for libexif addresses three vulnerabilities involving integer overflow and underflow in the handling and decoding of MakerNotes, specifically affecting Nikon MakerNote processing. These issues could lead to information disclosure, crashes, and denial of service. The update fixes CVE-2026-40385, CVE-2026-40386, and CVE-2026-32775. No CVSS score is provided, but the impact includes medium severity issues such as crashes and information leaks.

Two vulnerabilities in the libexif library used by Red Hat Enterprise Linux 9.2 can lead to information disclosure, crashes, and denial of service. These issues stem from integer overflow and underflow errors in the handling and decoding of Nikon MakerNote metadata. The vulnerabilities have been rated with moderate severity by Red Hat Product Security. A security update addressing these issues is available for affected Red Hat Enterprise Linux 9.2 versions.

In libexif through 0.6.25, an unsigned 32bit integer overflow in Nikon MakerNote handling could be used by local attackers to cause crashes or information leaks. This only affects 32bit systems.