CVE-2026-3102 (GCVE-0-2026-3102)
Vulnerability from cvelistv5 – Published: 2026-02-24 14:32 – Updated: 2026-02-27 19:01 X_Open Source
VLAI?
Title
exiftool PNG File MacOS.pm SetMacOSTags os command injection
Summary
A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm of the component PNG File Parser. This manipulation of the argument DateTimeOriginal causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 13.50 is capable of addressing this issue. Patch name: e9609a9bcc0d32bd252a709a562fb822d6dd86f7. Upgrading the affected component is recommended.
Severity ?
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.347528 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.347528 | signaturepermissions-required |
| https://vuldb.com/?submit.758146 | third-party-advisory |
| https://www.youtube.com/watch?v=akk0vmilfb4 | media-coverage |
| https://github.com/exiftool/exiftool/commit/e9609… | patch |
| https://github.com/exiftool/exiftool/releases/tag/13.50 | patch |
| https://github.com/exiftool/exiftool/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | exiftool |
Affected:
13.0
Affected: 13.1 Affected: 13.2 Affected: 13.3 Affected: 13.4 Affected: 13.5 Affected: 13.6 Affected: 13.7 Affected: 13.8 Affected: 13.9 Affected: 13.10 Affected: 13.11 Affected: 13.12 Affected: 13.13 Affected: 13.14 Affected: 13.15 Affected: 13.16 Affected: 13.17 Affected: 13.18 Affected: 13.19 Affected: 13.20 Affected: 13.21 Affected: 13.22 Affected: 13.23 Affected: 13.24 Affected: 13.25 Affected: 13.26 Affected: 13.27 Affected: 13.28 Affected: 13.29 Affected: 13.30 Affected: 13.31 Affected: 13.32 Affected: 13.33 Affected: 13.34 Affected: 13.35 Affected: 13.36 Affected: 13.37 Affected: 13.38 Affected: 13.39 Affected: 13.40 Affected: 13.41 Affected: 13.42 Affected: 13.43 Affected: 13.44 Affected: 13.45 Affected: 13.46 Affected: 13.47 Affected: 13.48 Affected: 13.49 Unaffected: 13.50 |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-3102",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-27T19:00:50.001775Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-27T19:01:01.682Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"PNG File Parser"
],
"product": "exiftool",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "13.0"
},
{
"status": "affected",
"version": "13.1"
},
{
"status": "affected",
"version": "13.2"
},
{
"status": "affected",
"version": "13.3"
},
{
"status": "affected",
"version": "13.4"
},
{
"status": "affected",
"version": "13.5"
},
{
"status": "affected",
"version": "13.6"
},
{
"status": "affected",
"version": "13.7"
},
{
"status": "affected",
"version": "13.8"
},
{
"status": "affected",
"version": "13.9"
},
{
"status": "affected",
"version": "13.10"
},
{
"status": "affected",
"version": "13.11"
},
{
"status": "affected",
"version": "13.12"
},
{
"status": "affected",
"version": "13.13"
},
{
"status": "affected",
"version": "13.14"
},
{
"status": "affected",
"version": "13.15"
},
{
"status": "affected",
"version": "13.16"
},
{
"status": "affected",
"version": "13.17"
},
{
"status": "affected",
"version": "13.18"
},
{
"status": "affected",
"version": "13.19"
},
{
"status": "affected",
"version": "13.20"
},
{
"status": "affected",
"version": "13.21"
},
{
"status": "affected",
"version": "13.22"
},
{
"status": "affected",
"version": "13.23"
},
{
"status": "affected",
"version": "13.24"
},
{
"status": "affected",
"version": "13.25"
},
{
"status": "affected",
"version": "13.26"
},
{
"status": "affected",
"version": "13.27"
},
{
"status": "affected",
"version": "13.28"
},
{
"status": "affected",
"version": "13.29"
},
{
"status": "affected",
"version": "13.30"
},
{
"status": "affected",
"version": "13.31"
},
{
"status": "affected",
"version": "13.32"
},
{
"status": "affected",
"version": "13.33"
},
{
"status": "affected",
"version": "13.34"
},
{
"status": "affected",
"version": "13.35"
},
{
"status": "affected",
"version": "13.36"
},
{
"status": "affected",
"version": "13.37"
},
{
"status": "affected",
"version": "13.38"
},
{
"status": "affected",
"version": "13.39"
},
{
"status": "affected",
"version": "13.40"
},
{
"status": "affected",
"version": "13.41"
},
{
"status": "affected",
"version": "13.42"
},
{
"status": "affected",
"version": "13.43"
},
{
"status": "affected",
"version": "13.44"
},
{
"status": "affected",
"version": "13.45"
},
{
"status": "affected",
"version": "13.46"
},
{
"status": "affected",
"version": "13.47"
},
{
"status": "affected",
"version": "13.48"
},
{
"status": "affected",
"version": "13.49"
},
{
"status": "unaffected",
"version": "13.50"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "owl4444 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm of the component PNG File Parser. This manipulation of the argument DateTimeOriginal causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 13.50 is capable of addressing this issue. Patch name: e9609a9bcc0d32bd252a709a562fb822d6dd86f7. Upgrading the affected component is recommended."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T14:32:13.272Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-347528 | exiftool PNG File MacOS.pm SetMacOSTags os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.347528"
},
{
"name": "VDB-347528 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.347528"
},
{
"name": "Submit #758146 | Exiftool 13.49 Arbitrary Code Execution",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.758146"
},
{
"tags": [
"media-coverage"
],
"url": "https://www.youtube.com/watch?v=akk0vmilfb4"
},
{
"tags": [
"patch"
],
"url": "https://github.com/exiftool/exiftool/commit/e9609a9bcc0d32bd252a709a562fb822d6dd86f7"
},
{
"tags": [
"patch"
],
"url": "https://github.com/exiftool/exiftool/releases/tag/13.50"
},
{
"tags": [
"product"
],
"url": "https://github.com/exiftool/exiftool/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-02-24T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-02-24T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-02-24T10:58:48.000Z",
"value": "VulDB entry last update"
}
],
"title": "exiftool PNG File MacOS.pm SetMacOSTags os command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-3102",
"datePublished": "2026-02-24T14:32:13.272Z",
"dateReserved": "2026-02-24T09:53:41.654Z",
"dateUpdated": "2026-02-27T19:01:01.682Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-3102",
"date": "2026-05-15",
"epss": "0.00261",
"percentile": "0.49525"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-3102\",\"sourceIdentifier\":\"cna@vuldb.com\",\"published\":\"2026-02-24T15:21:41.317\",\"lastModified\":\"2026-04-29T01:00:01.613\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm of the component PNG File Parser. This manipulation of the argument DateTimeOriginal causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 13.50 is capable of addressing this issue. Patch name: e9609a9bcc0d32bd252a709a562fb822d6dd86f7. Upgrading the affected component is recommended.\"},{\"lang\":\"es\",\"value\":\"Se encontr\u00f3 una vulnerabilidad en exiftool hasta la versi\u00f3n 13.49 en macOS. Este problema afecta a la funci\u00f3n SetMacOSTags del archivo lib/Image/ExifTool/MacOS.pm del componente PNG File Parser. Si se manipula el argumento DateTimeOriginal se causa una inyecci\u00f3n de comandos. El ataque puede llevarse a cabo de forma remota. El exploit ha sido divulgado p\u00fablicamente y puede ser utilizado. Se puede solucionar el problema actualizando a la versi\u00f3n 13.50. Nombre del parche: e9609a9bcc0d32bd252a709a562fb822d6dd86f7. Se recomienda actualizar el componente afectado.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":2.1,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"PROOF_OF_CONCEPT\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L\",\"baseScore\":6.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":3.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"cna@vuldb.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-77\"},{\"lang\":\"en\",\"value\":\"CWE-78\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:exiftool_project:exiftool:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"13.50\",\"matchCriteriaId\":\"E1379709-89F5-4873-89F4-6439BCEBB943\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"387021A0-AF36-463C-A605-32EA7DAC172E\"}]}]}],\"references\":[{\"url\":\"https://github.com/exiftool/exiftool/\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Product\"]},{\"url\":\"https://github.com/exiftool/exiftool/commit/e9609a9bcc0d32bd252a709a562fb822d6dd86f7\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/exiftool/exiftool/releases/tag/13.50\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://vuldb.com/?ctiid.347528\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Permissions Required\"]},{\"url\":\"https://vuldb.com/?id.347528\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://vuldb.com/?submit.758146\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://www.youtube.com/watch?v=akk0vmilfb4\",\"source\":\"cna@vuldb.com\",\"tags\":[\"Exploit\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-3102\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-02-27T19:00:50.001775Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-02-27T19:00:54.635Z\"}}], \"cna\": {\"tags\": [\"x_open-source\"], \"title\": \"exiftool PNG File MacOS.pm SetMacOSTags os command injection\", \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"owl4444 (VulDB User)\"}], \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P\"}}, {\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 6.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C\"}}, {\"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 6.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C\"}}, {\"cvssV2_0\": {\"version\": \"2.0\", \"baseScore\": 7.5, \"vectorString\": \"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C\"}}], \"affected\": [{\"vendor\": \"n/a\", \"modules\": [\"PNG File Parser\"], \"product\": \"exiftool\", \"versions\": [{\"status\": \"affected\", \"version\": \"13.0\"}, {\"status\": \"affected\", \"version\": \"13.1\"}, {\"status\": \"affected\", \"version\": \"13.2\"}, {\"status\": \"affected\", \"version\": \"13.3\"}, {\"status\": \"affected\", \"version\": \"13.4\"}, {\"status\": \"affected\", \"version\": \"13.5\"}, {\"status\": \"affected\", \"version\": \"13.6\"}, {\"status\": \"affected\", \"version\": \"13.7\"}, {\"status\": \"affected\", \"version\": \"13.8\"}, {\"status\": \"affected\", \"version\": \"13.9\"}, {\"status\": \"affected\", \"version\": \"13.10\"}, {\"status\": \"affected\", \"version\": \"13.11\"}, {\"status\": \"affected\", \"version\": \"13.12\"}, {\"status\": \"affected\", \"version\": \"13.13\"}, {\"status\": \"affected\", \"version\": \"13.14\"}, {\"status\": \"affected\", \"version\": \"13.15\"}, {\"status\": \"affected\", \"version\": \"13.16\"}, {\"status\": \"affected\", \"version\": \"13.17\"}, {\"status\": \"affected\", \"version\": \"13.18\"}, {\"status\": \"affected\", \"version\": \"13.19\"}, {\"status\": \"affected\", \"version\": \"13.20\"}, {\"status\": \"affected\", \"version\": \"13.21\"}, {\"status\": \"affected\", \"version\": \"13.22\"}, {\"status\": \"affected\", \"version\": \"13.23\"}, {\"status\": \"affected\", \"version\": \"13.24\"}, {\"status\": \"affected\", \"version\": \"13.25\"}, {\"status\": \"affected\", \"version\": \"13.26\"}, {\"status\": \"affected\", \"version\": \"13.27\"}, {\"status\": \"affected\", \"version\": \"13.28\"}, {\"status\": \"affected\", \"version\": \"13.29\"}, {\"status\": \"affected\", \"version\": \"13.30\"}, {\"status\": \"affected\", \"version\": \"13.31\"}, {\"status\": \"affected\", \"version\": \"13.32\"}, {\"status\": \"affected\", \"version\": \"13.33\"}, {\"status\": \"affected\", \"version\": \"13.34\"}, {\"status\": \"affected\", \"version\": \"13.35\"}, {\"status\": \"affected\", \"version\": \"13.36\"}, {\"status\": \"affected\", \"version\": \"13.37\"}, {\"status\": \"affected\", \"version\": \"13.38\"}, {\"status\": \"affected\", \"version\": \"13.39\"}, {\"status\": \"affected\", \"version\": \"13.40\"}, {\"status\": \"affected\", \"version\": \"13.41\"}, {\"status\": \"affected\", \"version\": \"13.42\"}, {\"status\": \"affected\", \"version\": \"13.43\"}, {\"status\": \"affected\", \"version\": \"13.44\"}, {\"status\": \"affected\", \"version\": \"13.45\"}, {\"status\": \"affected\", \"version\": \"13.46\"}, {\"status\": \"affected\", \"version\": \"13.47\"}, {\"status\": \"affected\", \"version\": \"13.48\"}, {\"status\": \"affected\", \"version\": \"13.49\"}, {\"status\": \"unaffected\", \"version\": \"13.50\"}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-02-24T00:00:00.000Z\", \"value\": \"Advisory disclosed\"}, {\"lang\": \"en\", \"time\": \"2026-02-24T01:00:00.000Z\", \"value\": \"VulDB entry created\"}, {\"lang\": \"en\", \"time\": \"2026-02-24T10:58:48.000Z\", \"value\": \"VulDB entry last update\"}], \"references\": [{\"url\": \"https://vuldb.com/?id.347528\", \"name\": \"VDB-347528 | exiftool PNG File MacOS.pm SetMacOSTags os command injection\", \"tags\": [\"vdb-entry\", \"technical-description\"]}, {\"url\": \"https://vuldb.com/?ctiid.347528\", \"name\": \"VDB-347528 | CTI Indicators (IOB, IOC, TTP, IOA)\", \"tags\": [\"signature\", \"permissions-required\"]}, {\"url\": \"https://vuldb.com/?submit.758146\", \"name\": \"Submit #758146 | Exiftool 13.49 Arbitrary Code Execution\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://www.youtube.com/watch?v=akk0vmilfb4\", \"tags\": [\"media-coverage\"]}, {\"url\": \"https://github.com/exiftool/exiftool/commit/e9609a9bcc0d32bd252a709a562fb822d6dd86f7\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/exiftool/exiftool/releases/tag/13.50\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/exiftool/exiftool/\", \"tags\": [\"product\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm of the component PNG File Parser. This manipulation of the argument DateTimeOriginal causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 13.50 is capable of addressing this issue. Patch name: e9609a9bcc0d32bd252a709a562fb822d6dd86f7. Upgrading the affected component is recommended.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-78\", \"description\": \"OS Command Injection\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-77\", \"description\": \"Command Injection\"}]}], \"providerMetadata\": {\"orgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"shortName\": \"VulDB\", \"dateUpdated\": \"2026-02-24T14:32:13.272Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-3102\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-02-27T19:01:01.682Z\", \"dateReserved\": \"2026-02-24T09:53:41.654Z\", \"assignerOrgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"datePublished\": \"2026-02-24T14:32:13.272Z\", \"assignerShortName\": \"VulDB\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…