CVE-2026-3102 | exiftool up to 13.49 on macOS PNG File Parser MacOS.pm SetMacOSTags DateTimeOriginal os command injection

A vulnerability was found in exiftool up to 13.49 on macOS. It has been classified as critical. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm of the component PNG File Parser. This manipulation of the argument DateTimeOriginal causes os command injection.

This vulnerability is tracked as CVE-2026-3102. The attack is possible to be carried out remotely. Moreover, an exploit is present.

Upgrading the affected component is recommended.