CVE-2026-3102
A vulnerability was determined in exiftool up to 13.49 on macOS.
Does this matter?
Lower severity and a low EPSS score (3.75%). Track it; it rarely justifies an emergency change on its own.
Description
A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm of the component PNG File Parser. This manipulation of the argument DateTimeOriginal causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 13.50 is capable of addressing this issue. Patch name: e9609a9bcc0d32bd252a709a562fb822d6dd86f7. Upgrading the affected component is recommended.
- CVSS 4.0
- 2.1 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 3.75% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-77, CWE-78
- Affected
- exiftool project/exiftool
- Source
- cna@vuldb.com
References
- https://github.com/exiftool/exiftool/Product
- https://github.com/exiftool/exiftool/commit/e9609a9bcc0d32bd252a709a562fb822d6dd86f7Patch
- https://github.com/exiftool/exiftool/releases/tag/13.50Release Notes
- https://vuldb.com/?ctiid.347528Permissions Required
- https://vuldb.com/?id.347528Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.758146Exploit, Third Party Advisory, VDB Entry
- https://www.youtube.com/watch?v=akk0vmilfb4Exploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.