CVE-2026-32775

A flaw was found in libexif. When decoding MakerNotes, an integer underflow can occur in the exif_mnote_data_get_value function if a zero size is passed. This can lead to a buffer overwrite, potentially allowing an attacker to achieve arbitrary code execution, disclose sensitive information, or cause a denial of service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid processing untrusted image files that may contain specially crafted EXIF MakerNotes. Restrict the use of applications that process EXIF data to trusted sources only.