libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow.
0.6.21-20.6.21-2ubuntu0.10.6.21-2ubuntu0.20.6.21-2ubuntu0.50.6.21-2ubuntu0.60.6.21-2.10.6.21-40.6.21-4ubuntu0.10.6.21-4ubuntu0.20.6.21-4ubuntu0.50.6.21-4ubuntu0.60.6.21-5.10.6.21-60.6.21-6ubuntu0.10.6.21-6ubuntu0.30.6.21-6ubuntu0.40.6.24-1ubuntu0.22.04.10.6.24-1ubuntu0.24.04.10.6.25-10.6.25-2ubuntu0.10.6.21-10.6.21-1ubuntu10.6.21-1ubuntu1+esm10.6.21-1ubuntu1+esm20.6.21-1ubuntu1+esm50.6.21-1ubuntu1+esm6Exploitability
AV:LAC:HPR:NUI:NScope
S:UImpact
C:HI:HA:HCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H