CVE catalog
CVE-2026-3102
A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm of the component PNG File Parser. This manipulatio
- Severity
- High · CVSS 8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 3.95% · Oct 25, 2026
A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm of the component PNG File Parser. This manipulation of the argument DateTimeOriginal causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 13.50 is capable of addressing this issue. Patch name: e9609a9bcc0d32bd252a709a562fb822d6dd86f7. Upgrading the affected component is recommended.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | libimage-exiftool-perl | sid | 13.55+dfsg-1 | not affected |
| Debian | libimage-exiftool-perl | forky | 13.55+dfsg-1 | not affected |
| Debian | libimage-exiftool-perl | trixie | 13.25+dfsg-1 | not affected |
| Debian | libimage-exiftool-perl | bookworm | 12.57+dfsg-1 | not affected |
| Cpe | libimage-exiftool-perl | Not reported | Not reported | not affected |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | libimage-exiftool-perl | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | libimage-exiftool-perl | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | libimage-exiftool-perl | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | libimage-exiftool-perl | source | bookworm | Not affected | unimportant | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libimage-exiftool-perl]Not affected
Details (2)
12.57+dfsg-1· all · bookwormNot affected
nvd · libimage-exiftool-perl · debian · bookworm
12.57+dfsg-1· all · bookwormNot affected
nvd · libimage-exiftool-perl · debian · bookworm
Observed:
References
- [https://nvd.nist.gov/vuln/detail/CVE-2026-3102]
- [https://security-tracker.debian.org/tracker/CVE-2026-3102]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3102.json]
[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX]