CVE-2026-3102
Medium
Description
A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm of the component PNG File Parser. This manipulation of the argument DateTimeOriginal causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 13.50 is capable of addressing this issue. Patch name: e9609a9bcc0d32bd252a709a562fb822d6dd86f7. Upgrading the affected component is recommended.
SeverityMedium
CVSS6.3
Exploit probability—
ProductExiftool
PublishedFeb 24, 2026
First seenFeb 24, 2026
Weakness typeCWE-78OS command injectionCWE-77Command injection
How to fix
Update
- exiftool_project exiftool13.50 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| exiftool_project exiftool | v < 13.50 | 13.50 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.