Ubuntu alert USN-8531-1 (libexif)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8531-1] libexif vulnerabilities
Date:
             
 
Mon, 13 Jul 2026 14:00:43 +0000
Message-ID:
             
 
<E1wjHD9-00071v-OR@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8531-1
July 13, 2026

libexif vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

Several security issues were fixed in libexif.

Software Description:
- libexif: library to parse EXIF files

Details:

It was discovered that libexif had an integer overflow in its MakerNote
decoder when called with a zero-length buffer. An attacker could possibly
use this issue to cause a denial of service or obtain sensitive
information. (CVE-2026-32775)

It was discovered that libexif had an integer overflow in its Nikon
MakerNote handler on 32-bit systems. A local attacker could possibly use
this issue to cause a denial of service or obtain sensitive information.
(CVE-2026-40385)

It was discovered that libexif had an integer underflow in its size
checking for Fuji and Olympus MakerNote decoding. An attacker could
possibly use this issue to cause a denial of service or obtain sensitive
information. (CVE-2026-40386)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  libexif12                       0.6.25-2ubuntu0.1

Ubuntu 24.04 LTS
  libexif12                       0.6.24-1ubuntu0.24.04.1

Ubuntu 22.04 LTS
  libexif12                       0.6.24-1ubuntu0.22.04.1

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8531-1
  CVE-2026-32775, CVE-2026-40385, CVE-2026-40386

Package Information:
  https://launchpad.net/ubuntu/+source/libexif/0.6.25-2ubun...
  https://launchpad.net/ubuntu/+source/libexif/0.6.24-1ubun...
  https://launchpad.net/ubuntu/+source/libexif/0.6.24-1ubun...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmpU7cYACgkQcpJm3tlz
hgEvng//W/XELK/NlTj1PWZmaRgSLF3gh+pEF4hJjiM2zKf4pbdgxFhZCD743O2N
RdBshLbgPl014/mn2FuS7fuWCGy9UsS47ii1zEUqvL1FA0nP4WUMp+CShUsLAFS7
pgTdO0myMu8NtXWcJ+QHMz/PW0QAIVYBf+xkVhMCoWnRbg7Ge/zUpQn0D+CeVirU
J9vvINzplRbjjPiJNKVbW6wDA58a0gz9rm9+SonFyf0NnmXE6fzlZxNtNxWjoqU3
mdcHPmdkWrTRn7vJHiDpaXEBaNm0jlSG7g6a/z05UcQ0b0mOgb89G+/yAq2+VTtM
u8UpTinDIAkOivUAQ/T+8Ztwr5zKOuqVrOv5gA/HgTQo8YNrPY8x9WRkxdTPjmg3
ph160ly10LXD1BNQPqKC06e/g+1G3G0+SdA/GWJ4raUI+20nd5q+p07xfwLCMmTV
3dMkoW1k9plHpJ2NDRYBNt7QJiNDCr1kHJzdJR8Epw0iX4VcwzeKES1FgLvhZp1G
Roq/cbD1wSv2cBnklZvc7Gp8iMxzc7WnlhPikfJmLgd+ZGjAtgjcU2MTKKtquR2q
Gbt96OnEaoMWihgMQU/w4KLSc8a7nYyQURv3eYavrzUbHSpVow4KH0j279jo5CQX
6EiV+jcl66tHHYiuPwqGzdn96uN8kXPHC2bIWVgoTHKVpgXj62k=
=Dfm2
-----END PGP SIGNATURE-----