CVE-2026-3102
Published: 24 February 2026
Summary
CVE-2026-3102 is a medium-severity Command Injection (CWE-77) vulnerability in Exiftool Project Exiftool. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 49.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely remediation of the OS command injection flaw in ExifTool by applying the patch to version 13.50.
Addresses command injection by enforcing validation and sanitization of inputs like the manipulated DateTimeOriginal argument in the PNG parser.
Enables vulnerability scanning to identify the presence of CVE-2026-3102 in ExifTool installations for prompt patching.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables exploitation of ExifTool via crafted PNG file for client-side code execution (T1203) and arbitrary OS command injection on macOS, facilitating Unix Shell usage (T1059.004).
NVD Description
A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm of the component PNG File Parser. This manipulation of the argument DateTimeOriginal causes os command injection. The attack is…
more
possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 13.50 is capable of addressing this issue. Patch name: e9609a9bcc0d32bd252a709a562fb822d6dd86f7. Upgrading the affected component is recommended.
Deeper analysisAI
CVE-2026-3102 is an OS command injection vulnerability affecting ExifTool versions up to 13.49 on macOS. The issue resides in the SetMacOSTags function within the lib/Image/ExifTool/MacOS.pm module of the PNG File Parser component. It is triggered by manipulation of the DateTimeOriginal argument, leading to command injection (CWE-77, CWE-78). The vulnerability carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L).
The attack can be carried out remotely by an unauthenticated attacker with network access who tricks a user into processing a specially crafted PNG file using the vulnerable ExifTool version. User interaction is required, such as opening or parsing the malicious file. Successful exploitation allows limited impact on confidentiality, integrity, and availability, enabling arbitrary OS command execution on the target's macOS system.
Mitigation is addressed by upgrading to ExifTool version 13.50, which includes the fixing commit e9609a9bcc0d32bd252a709a562fb822d6dd86f7. Upgrading the affected component is recommended, as detailed in the official GitHub repository, release notes, and commit history.
The exploit has been publicly disclosed and may be utilized, with further details available via VulDB entries.
Details
- CWE(s)