CVE-2026-32775: 
NixOS vulnerability analysis and mitigation

CVE-2026-32775 is an integer underflow vulnerability in libexif that occurs during MakerNotes decoding. When the exif_mnote_data_get_value function (and related per-manufacturer entry functions) receives a maxlen parameter of zero, a maxlen-- operation causes an integer underflow, converting the value to UINT_MAX (0xFFFFFFFF) and leading to a heap buffer overwrite. All versions of libexif through 0.6.25 are affected. The vulnerability was disclosed on March 16, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (Red Hat CVE, GitHub Issue).

The root cause is CWE-191 (Integer Underflow / Wrap or Wraparound). The flaw exists across multiple manufacturer-specific MakerNote entry functions in libexif — specifically in mnote-pentax-entry.c, mnote-apple-entry.c, mnote-canon-entry.c, mnote-fuji-entry.c, and mnote-olympus-entry.c. In each case, the function calls memset(val, 0, maxlen) followed by maxlen-- without first validating that maxlen >= 1; when maxlen is 0, the decrement wraps to UINT_MAX, and subsequent string operations use this enormous value as a buffer bound, causing a heap buffer overflow. Exploitation requires a user or application to open a crafted JPEG image containing malicious MakerNote EXIF metadata with a zero-size field. The vulnerability was discovered via automated static analysis and confirmed with AddressSanitizer (ASAN) (GitHub Issue, GitHub Commit).

Successful exploitation can result in arbitrary code execution, sensitive memory disclosure, or denial of service (application crash) depending on heap layout at the time of exploitation. Any application that uses libexif to process untrusted image files — including photo viewers, media libraries, and image processing pipelines — is potentially affected. The attack is local in vector (requires the victim to open a crafted file), but in environments where images are automatically processed (e.g., server-side thumbnail generation), the effective attack surface may be broader (Red Hat CVE, GitHub Issue).

1. Craft a malicious JPEG: Create a JPEG image with specially crafted MakerNote EXIF metadata (e.g., Pentax, Canon, Apple, Fuji, or Olympus MakerNote tags) where the size field for a MakerNote entry is set to zero.
2. Trigger parsing: Deliver the crafted JPEG to a target application that uses libexif for EXIF parsing — this could be a photo viewer, image editor, or server-side image processing service.
3. Induce integer underflow: When libexif calls the relevant mnote_*_entry_get_value() function with maxlen=0, the maxlen-- operation wraps to UINT_MAX (0xFFFFFFFF).
4. Heap buffer overflow: Subsequent string operations (e.g., snprintf, strncpy) use UINT_MAX as the buffer length, writing far beyond the allocated heap buffer.
5. Achieve objective: Depending on heap layout, the overflow may overwrite adjacent heap metadata or objects, potentially enabling arbitrary code execution, memory disclosure, or a crash/DoS (GitHub Issue, GitHub Commit).

• Process: Application crashes (segmentation faults or SIGABRT) in processes that parse JPEG/EXIF files, particularly in functions such as mnote_pentax_entry_get_value, mnote_canon_entry_get_value, mnote_apple_entry_get_value, mnote_fuji_entry_get_value, or mnote_olympus_entry_get_value.
• Logs: AddressSanitizer (ASAN) or Valgrind reports indicating heap buffer overflow originating from libexif MakerNote parsing functions; application crash logs referencing libexif shared library.
• File System: Presence of unexpected or malformed JPEG files with anomalous MakerNote EXIF structures (zero-size entries) in directories processed by vulnerable applications.
• Network: In server-side deployments, unusual upload activity of JPEG files followed by application crashes or unexpected process restarts (GitHub Issue).

The libexif project has released a patch (commit 7df372e) that adds a maxlen < 1 check before the decrement operation in all five affected MakerNote entry files, returning NULL immediately if maxlen is zero. Users should update libexif to a version incorporating this fix (beyond 0.6.25). Microsoft has also issued security updates for affected CBL-Mariner and Azure Linux packages via the Microsoft Security Response Center. Downstream distributions including Debian, Slackware, openSUSE, and Mageia have released updated packages. As a workaround where patching is not immediately possible, restrict or disable processing of untrusted EXIF data and validate image inputs before passing them to libexif (GitHub Commit, Microsoft MSRC, Debian LTS).

The vulnerability received routine coverage across Linux distribution security channels, with Debian, Slackware, openSUSE, and Mageia all issuing advisories and updated packages. The Yocto Project security mailing list also flagged the issue for embedded Linux users. Community discussion was limited, with no notable researcher commentary or significant social media amplification beyond automated CVE notification accounts (Debian LTS, openSUSE).