Log in Start free

Vulnerability · Published May 1, 2026 · Assigned by VulDB

CVE-2026-7580Exiftool JPEG/QuickTime/MOV/MP4 GM.pm Process_mrld code injection

Medium 5.3

In plain English

A medium-severity code injection in Exiftool. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 92.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in Exiftool up to 13.53. Impacted is the function Process_mrld of the file lib/Image/ExifTool/GM.pm of the component JPEG/QuickTime/MOV/MP4. The manipulation of the argument -ee results in code injection. Attacking locally is a requirement. Upgrading to version 13.54 is recommended to address this issue. The patch is identified as 5a8b6b6ead12b39e3f32f978a4efd0233facbb01. It is suggested to upgrade the affected component. The fix in the source code mentions: "[J]ust to be safe, probably never happen".

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13libimage-exiftool-perlno fix listedDEBIAN-CVE-2026-7580
Debian:14libimage-exiftool-perl13.55+dfsg-1DEBIAN-CVE-2026-7580
Ubuntu:22.04:LTSlibimage-exiftool-perlno fix listedUBUNTU-CVE-2026-7580
Ubuntu:24.04:LTSlibimage-exiftool-perlno fix listedUBUNTU-CVE-2026-7580
Ubuntu:25.10libimage-exiftool-perlno fix listedUBUNTU-CVE-2026-7580
Ubuntu:26.04:LTSlibimage-exiftool-perlno fix listedUBUNTU-CVE-2026-7580
Ubuntu:26.10libimage-exiftool-perlno fix listedUBUNTU-CVE-2026-7580

Affected products (as reported)

VendorProductVersions
n/a Exiftool 13.013.113.213.313.413.513.613.7

Weakness: CWE-94, CWE-74 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References