CVE-2026-38332: TinyEXIF Buffer Overflow Vulnerability

CVE-2026-38332 Overview

CVE-2026-38332 is a heap-based buffer over-read vulnerability in the TinyEXIF library affecting versions before 1.1.0. The flaw resides in the EntryParser::Fetch methods and is triggered when parsing a crafted EXIF SubjectArea tag with an attacker-controlled length. Applications that use TinyEXIF to parse untrusted image metadata may read memory beyond an allocated heap buffer, potentially causing a process crash or limited memory disclosure. The vulnerability is classified under CWE-125: Out-of-Bounds Read.

Critical Impact
Processing a malicious image with TinyEXIF may cause an out-of-bounds heap read in EntryParser::Fetch, leading to denial of service or exposure of adjacent heap memory contents.

Affected Products

TinyEXIF library versions prior to 1.1.0
Applications embedding vulnerable TinyEXIF builds for EXIF metadata parsing
Downstream image-processing tools that ingest untrusted images through TinyEXIF

Discovery Timeline

2026-09-13 - CVE-2026-38332 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-38332

Vulnerability Analysis

TinyEXIF is a small C++ library that parses EXIF and XMP metadata embedded in JPEG and TIFF images. The library uses an internal EntryParser helper to iterate over EXIF Image File Directory (IFD) entries and extract typed values from a memory buffer holding the file's metadata section.

The vulnerability occurs when the parser processes the EXIF SubjectArea tag. The tag encodes a variable number of 16-bit values describing the subject region within the frame. EntryParser::Fetch uses the attacker-controlled length field from the tag header to compute how many bytes to read, but does not validate the length against the remaining size of the EXIF data buffer.

A crafted image supplying an oversized SubjectArea length causes Fetch to read past the end of the heap allocation backing the EXIF payload. The read may leak adjacent heap contents to the caller or trigger a segmentation fault when the read crosses an unmapped page boundary.

Root Cause

The root cause is missing bounds validation between a length field parsed from untrusted image data and the actual size of the allocated buffer. The EntryParser::Fetch routines trust the tag-supplied count and multiply it by the entry element size without comparing the result to the buffer's remaining byte count.

Attack Vector

Exploitation requires an attacker to deliver a crafted image to an application linked against a vulnerable version of TinyEXIF. The application must call TinyEXIF to parse the image, at which point EntryParser::Fetch performs the out-of-bounds read. No authentication or user interaction with the library is required beyond the normal parsing invocation. The published CVSS metrics indicate a local attack vector with limited availability impact and no confidentiality or integrity impact.

Refer to GitHub Issue #24 and GitHub Pull Request #25 for the technical reproduction and patch details.

Detection Methods for CVE-2026-38332

Indicators of Compromise

Repeated crashes or aborts in processes that parse image metadata using TinyEXIF, especially with signals indicating invalid memory access.
AddressSanitizer or Valgrind reports flagging heap-buffer-overflow reads originating in EntryParser::Fetch call frames.
Unusual EXIF SubjectArea tags in ingested images whose declared count exceeds the plausible value range (typically 2 to 4 elements).

Detection Strategies

Perform software composition analysis (SCA) across build pipelines to identify TinyEXIF versions earlier than 1.1.0 embedded as source or as a git submodule.
Instrument image-ingestion services with sanitizer builds during QA to surface out-of-bounds reads before code reaches production.
Add fuzzing coverage for the EXIF parser using malformed SubjectArea and other variable-length tags to catch related boundary issues.

Monitoring Recommendations

Monitor crash telemetry from image-processing workers and correlate faults with recently ingested files.
Log the SHA-256 of images that trigger parser exceptions to enable retrospective analysis and sample retention.
Track dependency manifests for TinyEXIF version drift and alert when a build reintroduces a pre-1.1.0 release.

How to Mitigate CVE-2026-38332

Immediate Actions Required

Upgrade all builds that link TinyEXIF to version 1.1.0 or later and rebuild dependent binaries.
Inventory internal services, container images, and third-party tools that embed TinyEXIF, prioritizing those that process user-submitted images.
Restart long-running image-processing services after patching to ensure the updated library is loaded.

Patch Information

The fix is tracked in GitHub Pull Request #25 and documented in GitHub Security Advisory GHSA-jqj2-8c2j-gx82. Update to TinyEXIF 1.1.0 or newer to receive the corrected bounds check in EntryParser::Fetch.

Workarounds

If immediate patching is not feasible, pre-validate incoming images with a hardened parser that strips or normalizes EXIF metadata before invoking TinyEXIF.
Sandbox image-parsing workers using seccomp, AppArmor, or containerized isolation to contain the impact of a parser crash.
Reject or quarantine images whose EXIF SubjectArea tag reports a count outside the standard 2–4 element range.

bash

# Configuration example: pin a patched TinyEXIF revision in a CMake FetchContent block
FetchContent_Declare(
  tinyexif
  GIT_REPOSITORY https://github.com/cdcseacave/TinyEXIF.git
  GIT_TAG        v1.1.0
)
FetchContent_MakeAvailable(tinyexif)