TLDR Tech / InfoSec
How an image could compromise your Mac: understanding an ExifTool vulnerability (CVE-2026-3102)
GReAT discovered CVE-2026-3102 in ExifTool ≤13.49 on macOS where unsanitized date values in the SetMacOSTags function flow into a system() sink, allowing arbitrary command execution via metadata injection when the -n flag is used with -tagsFromFile to copy a crafted DateTimeOriginal tag into FileCreateDate. Attack chain: inject single quotes into DateTimeOriginal using -n flag (which bypasses PrintConvInv validation), then copy via -tagsFromFile to trigger SetMacOSTags with unescaped $val concatenated into /usr/bin/setfile -d 'PAYLOAD' 'FILE' enabling command substitution. Fix in 13.50 replaced string concatenation with list-form system() calls, eliminating manual escaping. Defenders must verify all photo-processing workflows, asset management tools, and bulk image scripts use ExifTool ≥13.50, isolate untrusted file processing on air-gapped machines, and enforce macOS endpoint protection on BYOD and contractor devices.
Read the full story