ExifTool: ExifTool Vulnerability Lets Malicious Images Trigger macOS Code Execution

Critical ExifTool Vulnerability Exposes macOS Systems to Code Execution via Malicious Images

A severe vulnerability in ExifTool, a widely used open-source utility for reading and editing image metadata, has been discovered, allowing attackers to execute arbitrary code on macOS systems through specially crafted image files. Tracked as CVE-2026-3102, the flaw was uncovered by Kaspersky’s Global Research and Analysis Team (GReAT) and affects ExifTool versions 13.49 and earlier.

How the Exploit Works

ExifTool processes metadata such as timestamps, GPS coordinates, and camera details embedded in image files. The vulnerability stems from how the tool handles the DateTimeOriginal field, which stores the time a photo was taken. If this field contains malformed date values disguised as shell commands, macOS systems running vulnerable ExifTool versions can execute them under two conditions:

1. The system must be running macOS.
2. ExifTool must be executed with the -n (or --printConv) flag, which outputs raw numerical data without conversion.

When triggered, the exploit allows attackers to download and execute payloads, including Trojans, infostealers, or backdoors, compromising the system.

Potential Attack Scenarios

Given ExifTool’s integration into digital asset management platforms, image editors, and automated processing scripts, the vulnerability poses a significant risk. A likely attack vector involves journalists, law firms, or analysts receiving an image for processing such as a photo for a news story or forensic investigation only for their system to automatically execute malicious code upon metadata extraction.

Mitigation and Response

The ExifTool developer released version 13.50 to patch the flaw. Users and organizations are advised to:

• Upgrade to ExifTool 13.50 or later immediately.
• Verify third-party software (e.g., photo editors, DAM systems) for embedded outdated ExifTool libraries.
• Audit automated image-processing scripts to ensure they reference the patched version.
• Isolate untrusted image processing in virtual environments or sandboxes to limit potential damage.

While macOS has historically been perceived as less vulnerable to such attacks, this incident underscores the risks of software supply chain threats, where even seemingly benign files like images can serve as attack vectors.

Source: https://gbhackers.com/exiftool-vulnerability/

Kaspersky cybersecurity rating report: https://www.rankiteo.com/company/kaspersky

"id": "KAS1773044624",
"linkid": "kaspersky",
"type": "Vulnerability",
"date": "1/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': ['Digital Asset Management',
                                     'Media',
                                     'Journalism',
                                     'Legal',
                                     'Forensic Analysis'],
                        'location': 'Global',
                        'name': 'ExifTool Users',
                        'type': 'Software Users'}],
 'attack_vector': 'Malicious Image Files (Metadata Exploitation)',
 'data_breach': {'file_types_exposed': ['Image files (e.g., JPEG, PNG)']},
 'description': 'A severe vulnerability in ExifTool, a widely used open-source '
                'utility for reading and editing image metadata, has been '
                'discovered, allowing attackers to execute arbitrary code on '
                'macOS systems through specially crafted image files. The '
                'flaw, tracked as CVE-2026-3102, was uncovered by Kaspersky’s '
                'Global Research and Analysis Team (GReAT) and affects '
                'ExifTool versions 13.49 and earlier. The vulnerability stems '
                'from how ExifTool handles the DateTimeOriginal field, which '
                'can execute malformed date values disguised as shell commands '
                'if processed with the -n flag on macOS systems.',
 'impact': {'operational_impact': 'Potential arbitrary code execution leading '
                                  'to system compromise',
            'systems_affected': 'macOS systems running ExifTool versions 13.49 '
                                'and earlier'},
 'lessons_learned': 'The incident underscores the risks of software supply '
                    'chain threats, where even benign files like images can '
                    'serve as attack vectors. Organizations should prioritize '
                    'patch management and isolate untrusted processing '
                    'environments.',
 'post_incident_analysis': {'corrective_actions': ['Patch ExifTool to version '
                                                   '13.50',
                                                   'Implement sandboxing for '
                                                   'untrusted image '
                                                   'processing'],
                            'root_causes': 'Improper handling of the '
                                           'DateTimeOriginal field in '
                                           'ExifTool, allowing shell command '
                                           'injection when processed with the '
                                           '-n flag on macOS systems'},
 'recommendations': ['Upgrade to ExifTool 13.50 or later',
                     'Verify third-party software for embedded outdated '
                     'ExifTool libraries',
                     'Audit automated image-processing scripts',
                     'Isolate untrusted image processing in virtual '
                     'environments or sandboxes'],
 'references': [{'source': 'Kaspersky’s Global Research and Analysis Team '
                           '(GReAT)'}],
 'response': {'containment_measures': 'Upgrade to ExifTool 13.50 or later',
              'remediation_measures': ['Verify third-party software for '
                                       'outdated ExifTool libraries',
                                       'Audit automated image-processing '
                                       'scripts',
                                       'Isolate untrusted image processing in '
                                       'sandboxes']},
 'title': 'Critical ExifTool Vulnerability Exposes macOS Systems to Code '
          'Execution via Malicious Images',
 'type': 'Vulnerability Exploitation',
 'vulnerability_exploited': 'CVE-2026-3102'}