CVE-2026-3102

exiftool PNG File MacOS.pm SetMacOSTags os command injection

State: Published
Severity: 5.3 Medium
Published: Feb 24, 2026
Updated: Feb 27, 2026
Reserved: Feb 24, 2026

Description

A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm of the component PNG File Parser. This manipulation of the argument DateTimeOriginal causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 13.50 is capable of addressing this issue. Patch name: e9609a9bcc0d32bd252a709a562fb822d6dd86f7. Upgrading the affected component is recommended.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-78 OS Command Injection
CWE-77 Command Injection

Affected Products

Product	Versions
exiftooln/a	13.0Affected 13.1Affected 13.2Affected 13.3Affected 13.4Affected 13.5Affected 13.6Affected 13.7Affected 13.8Affected 13.9Affected 13.10Affected 13.11Affected 13.12Affected 13.13Affected 13.14Affected 13.15Affected 13.16Affected 13.17Affected 13.18Affected 13.19Affected 13.20Affected 13.21Affected 13.22Affected 13.23Affected 13.24Affected and 26 more versions

References

VDB-347528 | exiftool PNG File MacOS.pm SetMacOSTags os command injectionvdb-entrytechnical-description
VDB-347528 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #758146 | Exiftool 13.49 Arbitrary Code Executionthird-party-advisory
https://www.youtube.com/watch?v=akk0vmilfb4media-coverage
https://github.com/exiftool/exiftool/commit/e9609a9bcc0d32bd252a709a562fb822d6dd86f7patch
https://github.com/exiftool/exiftool/releases/tag/13.50patch
https://github.com/exiftool/exiftool/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.