CVE-2026-40385: 
NixOS vulnerability analysis and mitigation

CVE-2026-40385 is an integer overflow vulnerability in libexif through version 0.6.25, affecting Nikon MakerNote handling during EXIF metadata parsing. The flaw is triggered when processing specially crafted image files on 32-bit systems, potentially leading to application crashes or memory information leaks. It was published on April 12, 2026, with a patch committed to the libexif repository shortly after. The vulnerability carries a CVSS v3.1 base score of 7.1 (High) per NVD, though ENISA's EUVD rates it lower at 4.0 (GitHub Advisory, Red Hat CVE).

The root cause is an unsigned 32-bit integer overflow (CWE-190) in the exif_mnote_data_olympus_load function within libexif/olympus/exif-mnote-data-olympus.c. Specifically, the expression o2 = datao + exif_get_long(buf + o2, n->order) could overflow on systems where size_t is 32-bit unsigned, causing out-of-bounds reads of data buffers and subsequent misparse of EXIF metadata or crashes. The fix adds a CHECKOVERFLOW guard before the addition to prevent the overflow condition. Exploitation requires a local attacker to supply a maliciously crafted image file with specially constructed Nikon MakerNote metadata to an application using libexif on a 32-bit system (libexif commit, GitHub Advisory).

Successful exploitation can result in denial of service (application crash) or information disclosure through out-of-bounds memory reads on affected 32-bit systems. The vulnerability does not affect integrity and has no impact on 64-bit systems where size_t is 64-bit. Applications and services that process untrusted image files using libexif — such as photo management tools, media servers, or image processing pipelines — are at risk of service disruption or leaking sensitive in-memory data (GitHub Advisory, Red Hat CVE).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.000130), reflecting a very low probability of exploitation in the near term. Exploitation is constrained to local attackers on 32-bit systems, significantly limiting the attack surface (GitHub Advisory).

1. Identify target: Locate a 32-bit system running an application that uses libexif ≤ 0.6.25 to process image metadata (e.g., a photo viewer, media indexer, or image processing service).
2. Craft malicious image: Create a JPEG or TIFF image file with a specially crafted Nikon MakerNote EXIF block where the offset value in the MakerNote header is set to cause datao + exif_get_long(buf + o2, n->order) to overflow a 32-bit size_t.
3. Deliver the image: As a local user, place the crafted image in a location where the target application will process it (e.g., a watched directory, upload endpoint, or shared folder).
4. Trigger parsing: Cause the application to parse the malicious image, triggering the integer overflow in exif_mnote_data_olympus_load.
5. Achieve objective: The overflow results in an out-of-bounds read, causing either a crash (denial of service) or leaking memory contents that may include sensitive data from the process (libexif commit, GitHub Advisory).

• File System: Presence of unexpected or externally sourced JPEG/TIFF image files with anomalous Nikon MakerNote EXIF structures in directories processed by libexif-dependent applications.
• Logs: Application crash logs or core dumps from processes using libexif (e.g., segmentation faults or abort signals) when processing specific image files; repeated errors in system logs from image processing daemons.
• Process: Unexpected termination or restart of image processing services or daemons on 32-bit systems; unusual memory access violation signals (SIGSEGV, SIGABRT) originating from libexif parsing routines.

Update libexif to a version newer than 0.6.25 that includes the security fix committed at libexif commit 93003b9. Distribution-specific patches have been released for Fedora, Debian (DLA-4558-1), AlmaLinux (ALSA-2026-20929), Red Hat (RHSA-2026:20929, RHSA-2026:22553), Slackware, openSUSE, and Mageia. As a workaround, restrict local user access to systems processing untrusted image files and avoid running libexif-dependent applications on 32-bit systems where patching is not immediately possible (Red Hat Errata, Debian LTS, GitHub Advisory).

The vulnerability received routine coverage from Linux distribution security teams, with advisories issued by Red Hat, Debian, Fedora, AlmaLinux, Rocky Linux, Slackware, openSUSE, and Mageia. Microsoft also published an advisory for affected Azure Linux packages (azl3_libexif and cbl2_libexif). No notable researcher commentary or significant social media discussion has been observed, consistent with the vulnerability's limited scope (32-bit systems only) and absence of public exploit code (Microsoft MSRC, Red Hat CVE).