The vulnerability arises from an integer underflow during size verification when decoding Fuji and Olympus MakerNote data. This flaw can cause libexif to crash or expose internal memory contents, resulting in potential loss of availability or leakage of sensitive information processed by the library.

The libexif project’s libexif component is affected in all releases up through version 0.6.25. Applications that incorporate libexif for handling image metadata are at risk.

The CVSS score of 4.0 indicates a moderate risk. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local or remote exploitation by supplying a crafted image that forces the library to process malformed MakerNote sections. Exploitation would require the target program to parse such an image, a condition that is relatively easy to satisfy for any image-capturing or viewing software using libexif.