VulnerabilityAnalyzed
CVE-2026-40385
In libexif through 0.6.25, an unsigned 32bit integer overflow in Nikon MakerNote handling could be used by local attackers to cause crashes or information leaks.
HIGH 7.1EPSS 0.09%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.09%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In libexif through 0.6.25, an unsigned 32bit integer overflow in Nikon MakerNote handling could be used by local attackers to cause crashes or information leaks. This only affects 32bit systems.
- CVSS 3.1
- 7.1 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- EPSS
- 0.09% probability · 1th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-190
- Affected
- libexif project/libexif
- Source
- cve@mitre.org
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.