CVE-2026-7580

Exiftool JPEG/QuickTime/MOV/MP4 GM.pm Process_mrld code injection

State: Published
Severity: 4.8 Medium
Published: May 1, 2026
Updated: May 1, 2026
Reserved: May 1, 2026

Description

A vulnerability was detected in Exiftool up to 13.53. Impacted is the function Process_mrld of the file lib/Image/ExifTool/GM.pm of the component JPEG/QuickTime/MOV/MP4. The manipulation of the argument -ee results in code injection. Attacking locally is a requirement. Upgrading to version 13.54 is recommended to address this issue. The patch is identified as 5a8b6b6ead12b39e3f32f978a4efd0233facbb01. It is suggested to upgrade the affected component. The fix in the source code mentions: "[J]ust to be safe, probably never happen".

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	5.3 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	5.3 Medium	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	4.3 Medium	AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-94 Code Injection
CWE-74 Injection

Affected Products

Product	Versions
Exiftooln/a	13.0Affected 13.1Affected 13.2Affected 13.3Affected 13.4Affected 13.5Affected 13.6Affected 13.7Affected 13.8Affected 13.9Affected 13.10Affected 13.11Affected 13.12Affected 13.13Affected 13.14Affected 13.15Affected 13.16Affected 13.17Affected 13.18Affected 13.19Affected 13.20Affected 13.21Affected 13.22Affected 13.23Affected 13.24Affected and 30 more versions

References

VDB-360421 | Exiftool JPEG/QuickTime/MOV/MP4 GM.pm Process_mrld code injectionvdb-entrytechnical-description
VDB-360421 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #800049 | Exiftool Project Exiftool Before 13.54 Code Injectionthird-party-advisory
https://youtu.be/WktMPapQxlMmedia-coverage
https://github.com/exiftool/exiftool/commit/5a8b6b6ead12b39e3f32f978a4efd0233facbb01#diff-5a95c56c6f98f0aa538233fd81bb9967154f3e9ebd4126a98dfb126c4c5629a4patch
https://github.com/exiftool/exiftool/commit/5a8b6b6ead12b39e3f32f978a4efd0233facbb01patch
https://github.com/exiftool/exiftool/releases/tag/13.54patch
https://github.com/exiftool/exiftool/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.