CVE-2020-13112

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-05-21 · updated 2026-06-17
Weakness: CWE-125

Description

An issue was discovered in libexif before 0.6.22. Several buffer over-reads in EXIF MakerNote handling could lead to information disclosure and crashes. This is different from CVE-2020-0093.

Affected products

Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 18.04, 19.10, 20.04
Debian Linux: 8.0
libexif project libexif: before 0.6.22 — fixed in 0.6.22
openSUSE Leap: 15.1

How to fix

Upgrade to a fixed version: libexif project libexif 0.6.22. Check the vendor advisory for mitigations.

References

http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html
https://github.com/libexif/libexif/commit/435e21f05001fb03f9f186fa7cbc69454afd00d1
https://lists.debian.org/debian-lts-announce/2020/05/msg00025.html
https://security.gentoo.org/glsa/202007-05
https://usn.ubuntu.com/4396-1/
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html
https://github.com/libexif/libexif/commit/435e21f05001fb03f9f186fa7cbc69454afd00d1
https://lists.debian.org/debian-lts-announce/2020/05/msg00025.html
https://security.gentoo.org/glsa/202007-05
https://usn.ubuntu.com/4396-1/

Get alerted when CVE-2020-13112 or the next vulnerability affects your stack