MGASA-2026-0112

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2026-0112.html
Import Source
https://advisories.mageia.org/MGASA-2026-0112.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2026-0112
Upstream
  • CVE-2026-40385
  • CVE-2026-40386
Published
2026-05-07T05:06:13Z
Modified
2026-05-07T05:15:39.239151Z
Summary
Updated libexif packages fix security vulnerabilities
Details

CVE-2026-32775: libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exifmnotedatagetvalue function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow. CVE-2026-40385: In libexif through 0.6.25, an unsigned 32bit integer overflow in Nikon MakerNote handling could be used by local attackers to cause crashes or information leaks. This only affects 32bit systems. CVE-2026-40386: In libexif through 0.6.25, an integer underflow in size checking for Fuji and Olympus MakerNote decoding could be used by attackers to crash or leak information out of libexif-using programs.

References
Credits

Affected packages

Mageia:9 / libexif

Package

Name
libexif
Purl
pkg:rpm/mageia/libexif?arch=source&distro=mageia-9

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.6.26-1.mga9

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2026-0112.json"