CVE-2026-3102 PUBLISHED

exiftool PNG File MacOS.pm SetMacOSTags os command injection

Assigner: VulDB
Reserved: 24.02.2026 Published: 24.02.2026 Updated: 24.02.2026

A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm of the component PNG File Parser. This manipulation of the argument DateTimeOriginal causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 13.50 is capable of addressing this issue. Patch name: e9609a9bcc0d32bd252a709a562fb822d6dd86f7. Upgrading the affected component is recommended.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS Score: 5.3

Product Status

Vendor n/a
Product exiftool
Versions
  • Version 13.0 is affected
  • Version 13.1 is affected
  • Version 13.2 is affected
  • Version 13.3 is affected
  • Version 13.4 is affected
  • Version 13.5 is affected
  • Version 13.6 is affected
  • Version 13.7 is affected
  • Version 13.8 is affected
  • Version 13.9 is affected
  • Version 13.10 is affected
  • Version 13.11 is affected
  • Version 13.12 is affected
  • Version 13.13 is affected
  • Version 13.14 is affected
  • Version 13.15 is affected
  • Version 13.16 is affected
  • Version 13.17 is affected
  • Version 13.18 is affected
  • Version 13.19 is affected
  • Version 13.20 is affected
  • Version 13.21 is affected
  • Version 13.22 is affected
  • Version 13.23 is affected
  • Version 13.24 is affected
  • Version 13.25 is affected
  • Version 13.26 is affected
  • Version 13.27 is affected
  • Version 13.28 is affected
  • Version 13.29 is affected
  • Version 13.30 is affected
  • Version 13.31 is affected
  • Version 13.32 is affected
  • Version 13.33 is affected
  • Version 13.34 is affected
  • Version 13.35 is affected
  • Version 13.36 is affected
  • Version 13.37 is affected
  • Version 13.38 is affected
  • Version 13.39 is affected
  • Version 13.40 is affected
  • Version 13.41 is affected
  • Version 13.42 is affected
  • Version 13.43 is affected
  • Version 13.44 is affected
  • Version 13.45 is affected
  • Version 13.46 is affected
  • Version 13.47 is affected
  • Version 13.48 is affected
  • Version 13.49 is affected
  • Version 13.50 is unaffected

Credits

  • owl4444 (VulDB User) reporter

References

Problem Types

  • OS Command Injection CWE
  • Command Injection CWE