The flaw resides in libexif's MakerNotes decoding routine. When the function exif_mnote_data_get_value is invoked with a buffer size of zero, an integer underflow occurs, causing memory to be written beyond the bounds of the supplied buffer. This buffer overrun can corrupt the process’s memory, potentially leading to arbitrary code execution or application crashes, depending on context. The weakness is identified as integer underflow (CWE‑191).

The affected product is the libexif library released by the libexif project. All versions up to and including 0.6.25 contain the vulnerability. Applications that embed or link against these legacy releases should verify whether they use an affected version. Users of newer releases (0.6.26 and later) are not impacted.

The CVSS base score of 7.4 indicates high severity. The EPSS score of less than 1% and the absence from the CISA KEV catalog suggest that exploit activity is currently limited. The vulnerability is triggered when malicious EXIF data is processed by libexif, which could occur via local file handling or through network paths that deliver image files. The exact attack vector cannot be confirmed from the data, but it is inferred that an attacker could supply a crafted file that triggers the integer underflow, leading to memory corruption and potentially compromising the host system.