CVE-2026-3102

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-3102
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3102.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-3102
Published
2026-02-24T14:32:13Z
Modified
2026-10-21T02:56:41Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
exiftool PNG File MacOS.pm SetMacOSTags os command injection
Details

A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm of the component PNG File Parser. This manipulation of the argument DateTimeOriginal causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 13.50 is capable of addressing this issue. Patch name: e9609a9bcc0d32bd252a709a562fb822d6dd86f7. Upgrading the affected component is recommended.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-77",
        "CWE-78"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3102.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "13.0"
                        },
                        {
                            "last_affected":  "13.0"
                        },
                        {
                            "introduced":  "13.1"
                        },
                        {
                            "last_affected":  "13.1"
                        },
                        {
                            "introduced":  "13.2"
                        },
                        {
                            "last_affected":  "13.2"
                        },
                        {
                            "introduced":  "13.3"
                        },
                        {
                            "last_affected":  "13.3"
                        },
                        {
                            "introduced":  "13.4"
                        },
                        {
                            "last_affected":  "13.4"
                        },
                        {
                            "introduced":  "13.5"
                        },
                        {
                            "last_affected":  "13.5"
                        },
                        {
                            "introduced":  "13.6"
                        },
                        {
                            "last_affected":  "13.6"
                        },
                        {
                            "introduced":  "13.7"
                        },
                        {
                            "last_affected":  "13.7"
                        },
                        {
                            "introduced":  "13.8"
                        },
                        {
                            "last_affected":  "13.8"
                        },
                        {
                            "introduced":  "13.9"
                        },
                        {
                            "last_affected":  "13.9"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandaloneSingleVersion"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/exiftool/exiftool

Affected ranges

Type
GIT
Repo
https://github.com/exiftool/exiftool
Events
Introduced
4d2f7239363d8e0afc7c14b1916601a6b65c498d
Fixed
e9609a9bcc0d32bd252a709a562fb822d6dd86f7
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "13.10"
                },
                {
                    "last_affected":  "13.10"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.11"
                },
                {
                    "last_affected":  "13.11"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.12"
                },
                {
                    "last_affected":  "13.12"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.13"
                },
                {
                    "last_affected":  "13.13"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.14"
                },
                {
                    "last_affected":  "13.14"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.15"
                },
                {
                    "last_affected":  "13.15"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.16"
                },
                {
                    "last_affected":  "13.16"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.17"
                },
                {
                    "last_affected":  "13.17"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.18"
                },
                {
                    "last_affected":  "13.18"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.19"
                },
                {
                    "last_affected":  "13.19"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.20"
                },
                {
                    "last_affected":  "13.20"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.21"
                },
                {
                    "last_affected":  "13.21"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.22"
                },
                {
                    "last_affected":  "13.22"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.23"
                },
                {
                    "last_affected":  "13.23"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.24"
                },
                {
                    "last_affected":  "13.24"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.25"
                },
                {
                    "last_affected":  "13.25"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.26"
                },
                {
                    "last_affected":  "13.26"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.27"
                },
                {
                    "last_affected":  "13.27"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.28"
                },
                {
                    "last_affected":  "13.28"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.29"
                },
                {
                    "last_affected":  "13.29"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.30"
                },
                {
                    "last_affected":  "13.30"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.31"
                },
                {
                    "last_affected":  "13.31"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.32"
                },
                {
                    "last_affected":  "13.32"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.33"
                },
                {
                    "last_affected":  "13.33"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.34"
                },
                {
                    "last_affected":  "13.34"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.35"
                },
                {
                    "last_affected":  "13.35"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.36"
                },
                {
                    "last_affected":  "13.36"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.37"
                },
                {
                    "last_affected":  "13.37"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.38"
                },
                {
                    "last_affected":  "13.38"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.39"
                },
                {
                    "last_affected":  "13.39"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.40"
                },
                {
                    "last_affected":  "13.40"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.41"
                },
                {
                    "last_affected":  "13.41"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.42"
                },
                {
                    "last_affected":  "13.42"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.43"
                },
                {
                    "last_affected":  "13.43"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.44"
                },
                {
                    "last_affected":  "13.44"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.45"
                },
                {
                    "last_affected":  "13.45"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.46"
                },
                {
                    "last_affected":  "13.46"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.47"
                },
                {
                    "last_affected":  "13.47"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.48"
                },
                {
                    "last_affected":  "13.48"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "13.49"
                },
                {
                    "last_affected":  "13.49"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "fixed":  "e9609a9bcc0d32bd252a709a562fb822d6dd86f7"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "13.50",
            "range":  [
                {
                    "fixed":  "e9609a9bcc0d32bd252a709a562fb822d6dd86f7"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

13.*
13.10
13.11
13.12
13.13
13.14
13.15
13.16
13.17
13.18
13.19
13.20
13.21
13.22
13.23
13.24
13.25
13.26
13.27
13.28
13.29
13.30
13.31
13.32
13.33
13.34
13.35
13.36
13.37
13.38
13.39
13.40
13.41
13.42
13.43
13.44
13.45
13.46
13.47
13.48
13.49

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3102.json"