CVE catalog

CVE-2026-7580

A vulnerability was detected in Exiftool up to 13.53. Impacted is the function Process_mrld of the file lib/Image/ExifTool/GM.pm of the component JPEG/QuickTime/MOV/MP4. The manipulation of the argume

[CVE catalog]

Severity
Low · CVSS 1.9
Published
Source
[NVD] · [CVE record]
EPSS
0.18% · Oct 25, 2026

A vulnerability was detected in Exiftool up to 13.53. Impacted is the function Process_mrld of the file lib/Image/ExifTool/GM.pm of the component JPEG/QuickTime/MOV/MP4. The manipulation of the argument -ee results in code injection. Attacking locally is a requirement. Upgrading to version 13.54 is recommended to address this issue. The patch is identified as 5a8b6b6ead12b39e3f32f978a4efd0233facbb01. It is suggested to upgrade the affected component. The fix in the source code mentions: "[J]ust to be safe, probably never happen".

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibimage-exiftool-perlsid13.55+dfsg-1fixed
Debianlibimage-exiftool-perlforky13.55+dfsg-1fixed
Debianlibimage-exiftool-perltrixie13.25+dfsg-1vulnerable
Debianlibimage-exiftool-perlbookworm12.57+dfsg-1not affected
Cpelibimage-exiftool-perlNot reportedNot reportednot affected

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibimage-exiftool-perlsourcesid13.55+dfsg-1not yet assignedNot reported[1135381]
Debianlibimage-exiftool-perlsourceforky13.55+dfsg-1not yet assignedNot reported[1135381]
Debianlibimage-exiftool-perlsourcetrixie(unfixed)not yet assignedNot reported[1135381]
Debianlibimage-exiftool-perlsourcebookwormNot affectedunimportantNot reported[1135381]

[Debian bug #1135381]

Notes

[trixie] libimage-exiftool-perl: Minor issue

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [libimage-exiftool-perl]Affected
    Details (2)

    • 13.25+dfsg-1 · all · trixie

      Affected

      nvd · libimage-exiftool-perl · debian · 13

    • 13.25+dfsg-1 · all · trixie

      Affected

      nvd · libimage-exiftool-perl · debian · 13

[Debian 12 (Bookworm)]

  • [libimage-exiftool-perl]Not affected
    Details (2)

    • 12.57+dfsg-1 · all · bookworm

      Not affected

      nvd · libimage-exiftool-perl · debian · bookworm

    • 12.57+dfsg-1 · all · bookworm

      Not affected

      nvd · libimage-exiftool-perl · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]