Description

A weakness has been identified in Matthias-Wandel jhead up to 3.3. This affects the function Get16u of the file exif.c of the component EXIF Parsing. This manipulation causes out-of-bounds read. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-14T05:16:58.537Z",
  "pubdate": "2026-09-14T05:16:58.537Z",
  "executiveSummary": "A critical out-of-bounds read vulnerability exists in Matthias-Wandel jhead up to version 3.3. The flaw is located within the EXIF parsing logic, specifically affecting the Get16u function in exif.c. This vulnerability allows for unauthorized memory access during the processing of malformed EXIF metadata. The vulnerability is classified as an out-of-bounds read, which could potentially be leveraged to leak sensitive information from the application's memory space or cause a denial-of-service condition through application crashing. The exploit for this vulnerability is currently public, increasing the risk of exploitation. Successful exploitation requires the attacker to have local access to the system to provide a maliciously crafted image file to the target utility. As the project maintainers have not yet provided a response or a patch to the reported issue, systems remain vulnerable to potential exploitation. Organizations relying on jhead for EXIF metadata extraction should assess their exposure and implement compensating controls, as there is currently no official vendor-supplied remediation.",
  "technicalDetails": "The vulnerability resides in the Get16u function within the exif.c file, a core component responsible for parsing EXIF metadata structures. The Get16u function is designed to read 16-bit unsigned integers from a byte stream. The root cause of the vulnerability is the lack of sufficient bounds checking on input buffers while processing malformed EXIF data. When the function attempts to retrieve 16-bit values from the EXIF header or tags, it does not adequately verify whether the pointer offset remains within the allocated memory boundaries of the image buffer.\nThe attack flow begins when a user or automated system executes the jhead utility on a specially crafted image file. The attacker embeds a malicious EXIF structure within the file, designed to manipulate the internal offset calculations used by the Get16u function. By providing an offset that points beyond the legitimate bounds of the input buffer, the attacker triggers an out-of-bounds read operation. Because the function reads data from the memory locations following the buffer, the application may inadvertently return sensitive heap or stack data to the user-interface or process it as valid EXIF metadata.\nExploitation requires local access, where the attacker can invoke the jhead binary on a chosen file. The exploit involves constructing an image file with crafted tag lengths or offsets that force the Get16u function to access memory addresses outside the intended memory segment. This behavior poses a significant risk to confidentiality, as memory contents, such as encryption keys, pointers, or stack cookies, could be inadvertently exposed if the application returns these values in its output. Additionally, if the memory read attempt occurs on an unmapped page or a protected region, it will trigger a segmentation fault, resulting in a denial-of-service state for the jhead process.\nThe vulnerability affects all versions of Matthias-Wandel jhead up to and including version 3.3. Given that the function is a primitive used throughout the EXIF parsing process, the risk of exploitation exists whenever the utility is pointed at an untrusted source image. The presence of a public exploit simplifies the attack process for malicious actors, necessitating immediate attention from system administrators despite the lack of an official upstream fix."
}