Vulnerabilities

CVSS

7.8 High

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Risk score

100.0

Known exploited

CISA KEV

Published

2021-04-23

Status

Analyzed

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

Weaknesses

CWE-94

Coverage 1

vulnerability

How an image could compromise your Mac: understanding an ExifTool vulnerability (CVE-2026-3102)

This article details a vulnerability (CVE-2026-3102) in ExifTool for macOS, allowing an attacker to execute arbitrary commands by injecting malicious data into the FileCreateDate metadata field. The vulnerability stems f…

Securelist · May 20, 2026 Critical

CVE-2026-3102CVE-2021-22204exiftoolmacosmetadata

All articles mentioning it

Advisories and references

• packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injectio...
• packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-E...
• packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Exec...
• packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-E...
• openwall.com/lists/oss-security/2021/05/09/1
• openwall.com/lists/oss-security/2021/05/10/5
• github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a...
• gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json
• hackerone.com/reports/1154542
• lists.debian.org/debian-lts-announce/2021/05/msg00018.html