A vulnerability was determined in exiftool up to 13

CVE-2026-3102 is a command-injection bug in ExifTool on macOS affecting versions up to and including 13.49, fixed in 13.50. Per the CVE/NVD record, the vulnerable path is SetMacOSTags in lib/Image/ExifTool/MacOS.pm, and the trigger is a crafted image whose metadata abuses DateTimeOriginal; Kaspersky's technical write-up adds the key real-world condition: exploitation requires the image to be processed on macOS with ExifTool's -n / --printConv mode enabled.

The vendor's MEDIUM 6.3 is directionally right, and if anything slightly generous for a broad enterprise estate. The technical impact is arbitrary command execution in the context of the ExifTool process, but the reachable population is sharply narrowed by three gates: macOS only, ExifTool 13.49 or earlier, and a workflow that actually processes attacker-controlled images with -n enabled. That keeps this out of emergency territory for most 10,000-host environments, but it stays above LOW because media, forensics, publishing, and DAM pipelines do exist and can automate exactly this kind of parsing.

Why this verdict

• Downward pressure: macOS only — this instantly removes Windows and Linux fleets from scope, which matters a lot in mixed enterprise estates.
• Downward pressure: vulnerable workflow requirement — the attacker needs a host that *processes untrusted images* with ExifTool, not just a host that happens to have the package installed.
• Downward pressure: -n / --printConv gate — Kaspersky's write-up says the exploit only lands when machine-readable output mode is enabled, which is common in some automation but far from universal.
• Upward pressure: code execution is still code execution — once the narrow path is hit, the outcome is shell command execution in the ExifTool process context, not a harmless parser crash.
• Downward pressure: no active exploitation signal — no KEV listing and a very low EPSS argue against treating this as a fire drill across 10,000 hosts.

Why not higher?

This is not broadly reachable infrastructure risk. The attacker must line up a specialized chain: deliver a malicious image, hit a Mac, hit ExifTool <=13.49, and hit a workflow that uses -n or --printConv. Those compounding prerequisites slash the exposed population compared with a true unauthenticated remote service RCE.

Why not lower?

It stays above LOW because the bug can execute arbitrary commands, not just leak metadata or crash a process. In organizations with digital asset management, photo ingestion, investigative media handling, or macOS-based automation, the exploit path is plausible enough that you should inventory and patch it rather than dismiss it as theoretical.

1. Isolate untrusted image processing — Run external or partner-supplied images through a dedicated low-privilege Mac worker or disposable VM so a hit lands in a small blast radius. For a MEDIUM verdict there is no mitigation SLA, but this is the best temporary control if patching lags.
2. Strip -n from wrappers where not required — Review launchd jobs, shell scripts, DAM connectors, and app wrappers that call exiftool; if machine-readable numeric output is not essential, remove -n / --printConv from those invocations. For MEDIUM, there is no mitigation SLA; use this as a targeted risk reduction for exposed workflows.
3. Constrain the runtime account — Make sure the service or user account invoking ExifTool has minimal local privileges and tightly limited network reach. That won't fix the bug, but it cuts post-exploitation payoff while you work through the 365-day remediation window.
4. Alert on child processes from ExifTool — Tune EDR to flag exiftool spawning shells, interpreters, or download utilities such as sh, bash, zsh, osascript, curl, or python. There is no mitigation SLA for MEDIUM, but this is high-value detective coverage immediately.

Run this on the target macOS host or your Mac image-processing worker, not from an auditor workstation. Invoke it as bash check_cve_2026_3102.sh /usr/local/bin/exiftool or simply bash check_cve_2026_3102.sh; no root is required for version checking, but sudo helps if you want the optional wrapper scan under /Library and /Applications to be more complete.

#!/usr/bin/env bash
# check_cve_2026_3102.sh
# Detect likely exposure to CVE-2026-3102 on macOS ExifTool hosts.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

TARGET="${1:-}"

verlte() {
  [ "$1" = "$2" ] && return 0
  local first
  first=$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)
  [ "$first" = "$1" ]
}

find_exiftool() {
  if [ -n "$TARGET" ] && [ -x "$TARGET" ]; then
    echo "$TARGET"
    return 0
  fi
  if command -v exiftool >/dev/null 2>&1; then
    command -v exiftool
    return 0
  fi
  for p in /opt/homebrew/bin/exiftool /usr/local/bin/exiftool /usr/bin/exiftool; do
    if [ -x "$p" ]; then
      echo "$p"
      return 0
    fi
  done
  return 1
}

scan_wrappers() {
  local hits=0
  local roots=(/usr/local /opt/homebrew /Library /Applications "$HOME")
  echo "[+] Optional wrapper scan for '-n' or '--printConv' references..." >&2
  for r in "${roots[@]}"; do
    [ -e "$r" ] || continue
    while IFS= read -r f; do
      echo "    reference: $f" >&2
      hits=$((hits+1))
    done < <(grep -RIlE '(^|[^A-Za-z0-9_-])(exiftool)([^A-Za-z0-9_-].*)(--printConv|-n)([^A-Za-z0-9_-]|$)|(--printConv|-n)([^A-Za-z0-9_-].*)(exiftool)' "$r" 2>/dev/null | head -n 20)
  done
  echo "[+] Wrapper references found: $hits" >&2
}

if [ "$(uname -s 2>/dev/null || true)" != "Darwin" ]; then
  echo "PATCHED"
  echo "Reason: CVE-2026-3102 is macOS-specific." >&2
  exit 0
fi

EXIFTOOL_BIN=$(find_exiftool || true)
if [ -z "$EXIFTOOL_BIN" ]; then
  echo "UNKNOWN"
  echo "Reason: exiftool binary not found in PATH or common locations." >&2
  exit 2
fi

VER_RAW=$("$EXIFTOOL_BIN" -ver 2>/dev/null || true)
VER=$(echo "$VER_RAW" | tr -dc '0-9.')
if [ -z "$VER" ]; then
  echo "UNKNOWN"
  echo "Reason: unable to determine ExifTool version from $EXIFTOOL_BIN" >&2
  exit 2
fi

echo "[+] exiftool: $EXIFTOOL_BIN" >&2
echo "[+] version : $VER" >&2

if verlte "$VER" "13.49"; then
  scan_wrappers
  echo "VULNERABLE"
  echo "Reason: macOS host with ExifTool <= 13.49. Confirm actual exploitability by checking whether workflows invoke exiftool with -n or --printConv on untrusted images." >&2
  exit 1
fi

echo "PATCHED"
echo "Reason: ExifTool version is newer than 13.49." >&2
exit 0

Sources

1. NVD CVE-2026-3102
2. CVE.org record for CVE-2026-3102
3. ExifTool version history
4. ExifTool 13.50 release
5. Fix commit e9609a9
6. Kaspersky technical analysis of CVE-2026-3102
7. FIRST EPSS overview
8. CISA Known Exploited Vulnerabilities Catalog