CVE-2026-40386

CVE-2026-40386 is an integer underflow vulnerability in libexif through version 0.6.25 that affects the MakerNote decoding functionality for Fuji and Olympus image formats. This flaw could allow attackers to crash applications using libexif or extract sensitive information from memory. The vulnerability has a CVSS score of 7.1 (HIGH) with a local attack vector requiring low privileges and user interaction, presenting significant confidentiality and availability risks. As of the current assessment, there is no evidence of active exploitation in the wild, with an extremely low EPSS score of 0.00005, and the vulnerability does not appear on the Known Exploited Vulnerabilities list. Community attention remains limited given its inactive status on threat tracking lists, though the moderate FAUCET risk score of 47.0 warrants monitoring and timely patch deployment for systems processing untrusted image files.