CVE-2026-32775: Integer Underflow
Last updated 13 July 2026
Other sources
libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exifmnotedatagetvalue function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libexifto a version that resolves this vulnerability.Fixed in 0.6.22-3+deb11u1Fixed in 0.6.24-1+deb12u1Fixed in 0.6.25-1+deb13u1Fixed in 0.6.26-1 - Upgrade
Upgrade
libexifto a version that resolves this vulnerability.Fixed in 0.6.25
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32775?
CVE-2026-32775 is considered a high severity vulnerability due to its potential for memory corruption.
How do I fix CVE-2026-32775?
To fix CVE-2026-32775, upgrade to a version of libexif later than 0.6.25 that addresses this integer underflow issue.
What type of systems are affected by CVE-2026-32775?
CVE-2026-32775 affects systems using libexif versions up to and including 0.6.25.
What is the impact of CVE-2026-32775?
The impact of CVE-2026-32775 may include the ability for attackers to execute arbitrary code due to memory corruption.
How can I determine if I am vulnerable to CVE-2026-32775?
You can determine if you are vulnerable to CVE-2026-32775 by checking if you are using libexif version 0.6.25 or earlier.