CVE-2020-13114

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-05-21 · updated 2026-06-17
Weakness: CWE-770

Description

An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote data could lead to consumption of large amounts of compute time for decoding EXIF data.

Affected products

Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 18.04, 19.10, 20.04
libexif project libexif: before 0.6.22 — fixed in 0.6.22
openSUSE Leap: 15.1

How to fix

Upgrade to a fixed version: libexif project libexif 0.6.22. Check the vendor advisory for mitigations.

References

http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html
https://github.com/libexif/libexif/commit/e6a38a1a23ba94d139b1fa2cd4519fdcfe3c9bab
https://lists.debian.org/debian-lts-announce/2020/05/msg00025.html
https://security.gentoo.org/glsa/202007-05
https://usn.ubuntu.com/4396-1/
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html
https://github.com/libexif/libexif/commit/e6a38a1a23ba94d139b1fa2cd4519fdcfe3c9bab
https://lists.debian.org/debian-lts-announce/2020/05/msg00025.html
https://security.gentoo.org/glsa/202007-05
https://usn.ubuntu.com/4396-1/

Get alerted when CVE-2020-13114 or the next vulnerability affects your stack