Critical ExifTool flaw lets attackers compromise Macs via one image

Key Takeaways

• A critical vulnerability, CVE-2026-3102, has been identified in ExifTool, a widely used metadata utility.
• This flaw allows attackers to execute arbitrary commands on macOS systems by embedding malicious code in image file metadata.
• Exploitation can lead to trojan deployment, data exfiltration, and network compromise, impacting macOS users, particularly those involved in image processing.
• The vulnerability has been patched in ExifTool version 13.50.

A severe security vulnerability has been discovered in ExifTool, a popular open-source utility for managing file metadata, posing a direct threat to macOS environments. This flaw enables attackers to compromise Apple systems through a seemingly innocuous image file.

Researchers from Kaspersky’s Global Research and Analysis Team (GReAT) uncovered the vulnerability, tracked as CVE-2026-3102, in February 2026. It allows malicious actors to embed arbitrary shell commands within an image file’s metadata, which ExifTool then executes.

By weaponizing a standard photograph, attackers can silently deploy malware, steal sensitive data, or gain a foothold within corporate networks for further lateral movement.

ExifTool Vulnerability Details

The root cause of the vulnerability lies in inadequate input sanitization, which permits untrusted data to flow into a dangerous execution sink within the application.

As detailed in their analysis, Kaspersky researchers pinpointed a specific flaw within ExifTool’s SetMacOSTags function. When ExifTool processes file creation dates on macOS, it interacts with the Spotlight system attribute MDItemFSCreationDate, which internally corresponds to FileCreateDate.

During metadata processing, the textual content of a relevant tag is assigned to the $val variable. If this tag aligns with file creation date attributes, this data is then passed directly into the SetMacOSTags function.

Crucially, while the filename parameter is correctly escaped before being passed to the system() call, the date value ($val) remains completely unsanitized. This oversight permits an attacker to inject single quotes, effectively breaking the command structure and executing arbitrary shell commands with the privileges of the user running ExifTool.

Payload Delivery and Filter Bypass

Directly writing a malformed date payload into the FileCreateDate field is prevented by ExifTool’s built-in PrintConvInv filter, which detects and rejects invalid date/time formats.

To circumvent this protective measure, attackers must employ the -n flag. This flag forces ExifTool to accept raw, unformatted machine-readable data, thereby bypassing the critical sanitization step.

The successful exploitation sequence leverages ExifTool’s copy mechanisms:

• Payload Staging: An attacker first injects a malicious payload, complete with single quotes, into a less restricted source tag, such as DateTimeOriginal, using the -n flag.
• Execution Trigger: Subsequently, the attacker utilizes the -tagsFromFile feature to copy the tainted metadata from the source tag into the vulnerable FileCreateDate field.

This method succeeds because the vulnerable code path is only activated during a copy operation, not a direct write. This ensures the unsanitized input is fed into the system() sink. ExifTool then invokes the macOS /usr/bin/setfile command, and the injected single quotes enable the payload to execute seamlessly through command substitution.

Following responsible disclosure, developers released ExifTool version 13.50, which addresses the flaw. The vulnerable version 13.49 relied on fragile string concatenation for constructing system commands. The patch fundamentally redesigns this architecture by abstracting the system call into a dedicated System() wrapper. Instead of executing a concatenated string, the application now securely passes a list of arguments to the system call. This shift from string-form to list-form execution completely eliminates shell interpretation risks, removing the need for manual escaping routines.

What You Should Do

• Immediately upgrade all installations of ExifTool to version 13.50 or newer.
• Audit all bulk image processing scripts and asset management applications that utilize ExifTool to ensure they are using the patched version.
• Scan macOS environments for any third-party software that might embed or rely on older, vulnerable versions of the ExifTool library.
• Isolate the processing of all untrusted files within dedicated virtual environments with strictly limited storage and network access.
• Implement and enforce robust BYOD (Bring Your Own Device) policies that mandate active macOS endpoint protection before devices can connect to corporate networks.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.