libexif Vulnerability Allows Code Execution and Denial-of-Service

CERT-Bund has released security advisory WID-SEC-2026-0739 detailing a critical vulnerability in the libexif library, affecting versions up to and including 0.6.25. This vulnerability, with a CVSS Base Score of 7.4, can be exploited by a local attacker to achieve arbitrary code execution, induce a denial-of-service state, or potentially reveal sensitive information. The advisory indicates that mitigation measures are available.

Organizations utilizing libexif, particularly those running UNIX-based systems or other systems that incorporate this library for EXIF data processing, should assess their exposure. While the advisory notes that remote attacks are not possible, the potential for local code execution and denial-of-service necessitates prompt review and application of available mitigations or updates to prevent exploitation. Affected parties should consult the advisory for specific mitigation steps and version information.