Threats Tagged 'cve-2026-40386'

This security update for libexif addresses three vulnerabilities involving integer overflow and underflow in the handling and decoding of MakerNotes, specifically affecting Nikon MakerNote processing. These issues could lead to information disclosure, crashes, and denial of service. The update fixes CVE-2026-40385, CVE-2026-40386, and CVE-2026-32775. No CVSS score is provided, but the impact includes medium severity issues such as crashes and information leaks.

A moderate severity vulnerability (CVE-2026-40386) affects the libexif library used for extracting metadata from image files. The flaw involves an integer underflow in the MakerNote decoding functionality, which can lead to denial of service and information disclosure. This issue impacts Red Hat Enterprise Linux 10.0 Extended Update Support and related CodeReady Linux Builder variants across multiple architectures. Red Hat has issued a security advisory with updated libexif packages to address this vulnerability.

Two vulnerabilities in the libexif library used by Red Hat Enterprise Linux 9.2 can lead to information disclosure, crashes, and denial of service. These issues stem from integer overflow and underflow errors in the handling and decoding of Nikon MakerNote metadata. The vulnerabilities have been rated with moderate severity by Red Hat Product Security. A security update addressing these issues is available for affected Red Hat Enterprise Linux 9.2 versions.

In libexif through 0.6.25, an integer underflow in size checking for Fuji and Olympus MakerNote decoding could be used by attackers to crash or leak information out of libexif-using programs.