ELSA-2026-20929 — Moderate: libexif security update (Oracle Linux 8)

Summary

[0.6.22-6]
- Fix integer underflow in MakerNote decoding (CVE-2026-40386)
- Fix integer overflow in Nikon MakerNote handling (CVE-2026-40385)
Resolves: RHEL-170243, RHEL-170220

Fixed packages 2

Release	Package	Fixed in
Oracle Linux · 8	libexif	0:0.6.22-6.el8_10
Oracle Linux · 8	libexif-devel	0:0.6.22-6.el8_10

Vulnerabilities 2

Medium 4.0

CVE-2026-40385

In libexif through 0.6.25, an unsigned 32bit integer overflow in Nikon MakerNote handling could be used by local attack…

libexif project libexif libexif libexif Debian Ubuntu Azure Linux Alpine

Apr 12, 2026
Medium 4.0

CVE-2026-40386

In libexif through 0.6.25, an integer underflow in size checking for Fuji and Olympus MakerNote decoding could be used …

libexif project libexif libexif libexif Debian Ubuntu Azure Linux Alpine

Apr 12, 2026

Moderate: libexif security update (Oracle Linux 8)

Summary

Fixed packages 2

Vulnerabilities 2

In libexif through 0.6.25, an unsigned 32bit integer overflow in Nikon MakerNote handling could be used by local attack…

In libexif through 0.6.25, an integer underflow in size checking for Fuji and Olympus MakerNote decoding could be used …