CVE-2026-3102

Name	CVE-2026-3102
Description	A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm of the component PNG File Parser. This manipulation of the argument DateTimeOriginal causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 13.50 is capable of addressing this issue. Patch name: e9609a9bcc0d32bd252a709a562fb822d6dd86f7. Upgrading the affected component is recommended.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libimage-exiftool-perl (PTS)	bullseye	12.16+dfsg-2	fixed
	bookworm	12.57+dfsg-1	fixed
	trixie	13.25+dfsg-1	fixed
	forky, sid	13.50+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libimage-exiftool-perl	source	(unstable)	(not affected)

- libimage-exiftool-perl <not-affected> (Only affects Image::ExifTool when run on MacOS)