TI-2026-02679 Aliases CVE-2026-3102 GHSA-mr6q-w873-6jfr

exiftool PNG File MacOS.pm SetMacOSTags os command injection

MEDIUM 57CWE-77Published 2026-02-24 · Updated 2026-02-27

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm of the component PNG File Parser. This manipulation of the argument DateTimeOriginal causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 13.50 is capable of addressing this issue. Patch name: e9609a9bcc0d32bd252a709a562fb822d6dd86f7. Upgrading the affected component is recommended.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.03953 90th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed exiftool: 13.50

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	exiftool	13.0; 13.1; 13.2; 13.3; 13.4; 13.5; 13.6; 13.7; 13.8; 13.9; 13.10; 13.11; 13.12; 13.13; 13.14; 13.15; 13.16; 13.17; 13.18; 13.19; 13.20; 13.21; 13.22; 13.23; 13.24; 13.25; 13.26; 13.27; 13.28; 13.29; 13.30; 13.31; 13.32; 13.33; 13.34; 13.35; 13.36; 13.37; 13.38; 13.39; 13.40; 13.41; 13.42; 13.43; 13.44; 13.45; 13.46; 13.47; 13.48; 13.49	13.50	Patch available	CNA

exiftool Vendor— Affected 13.0; 13.1; 13.2; 13.3; 13.4; 13.5; 13.6; 13.7; 13.8; 13.9; 13.10; 13.11; 13.12; 13.13; 13.14; 13.15; 13.16; 13.17; 13.18; 13.19; 13.20; 13.21; 13.22; 13.23; 13.24; 13.25; 13.26; 13.27; 13.28; 13.29; 13.30; 13.31; 13.32; 13.33; 13.34; 13.35; 13.36; 13.37; 13.38; 13.39; 13.40; 13.41; 13.42; 13.43; 13.44; 13.45; 13.46; 13.47; 13.48; 13.49 Fixed in 13.50 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:exiftool_project:exiftool::::::::	before 13.50	Vulnerable	Exiftool Project
cpe:2.3:o:apple:macos:-:::::::*	not specified by NVD	Running on	Apple

cpe:2.3:a:exiftool_project:exiftool:*:*:*:*:*:*:*:* Versions before 13.50 Vulnerable ·Exiftool Project
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple

Remediation

Fix · CNA exiftool Fixed in 13.50

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-3102
2026-10-03 Alias added: GHSA-mr6q-w873-6jfr
2026-10-25 EPSS moved to the 90th–95th percentile

References

Exploit 1

https://www.youtube.com/watch?v=akk0vmilfb4

Patch 2

Other 1

https://github.com/exiftool/exiftool/

TI-2021-05190 Code injection in ExifTool KEVCVSS 3.1HIGH 7.8
TI-2022-07911 lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\|$/ check, leading to command injection. CVSS 3.1HIGH 7.8
TI-2018-14322 ExifTool 8.32 allows local users to gain privileges by creating a… CVSS 3.0HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences