Description

A security vulnerability has been detected in Matthias-Wandel jhead up to 3.3. This impacts the function ProcessGpsInfo of the file gpsinfo.c of the component WebP EXIF Handler. Such manipulation of the argument TAG_GPS_LAT/TAG_GPS_LONG leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-14T05:16:58.730Z",
  "pubdate": "2026-09-14T05:16:58.730Z",
  "executiveSummary": "A critical heap-based buffer overflow vulnerability exists in jhead up to version 3.3, specifically within the WebP EXIF processing logic.\nThe vulnerability resides in the ProcessGpsInfo function in gpsinfo.c and is triggered by the improper handling of TAG_GPS_LAT and TAG_GPS_LONG arguments.\nSuccessful exploitation allows an attacker to cause a heap-based buffer overflow, which can lead to application crashes, potential memory corruption, or arbitrary code execution.\nThe vulnerability requires local access to the affected system, typically involving the processing of a maliciously crafted image file.\nGiven that the vulnerability has been publicly disclosed and the project maintainers have remained unresponsive, the risk of exploitation is elevated for systems that automatically process untrusted user-supplied EXIF data.\nUsers and administrators should be aware that this vulnerability enables a local attacker to compromise the integrity and availability of the host application.",
  "technicalDetails": "The vulnerability is a heap-based buffer overflow within the jhead utility, specifically impacting the EXIF parsing functionality related to GPS metadata. The flaw is located in the ProcessGpsInfo function within the gpsinfo.c file, which is tasked with interpreting Global Positioning System (GPS) information embedded within image files, including those utilizing the WebP container format.\nThe root cause of the vulnerability is an insufficient bounds check or improper size calculation when processing the TAG_GPS_LAT and TAG_GPS_LONG tags. When an attacker provides a specially crafted image containing malformed GPS tag data, the application fails to validate the length of the input data before copying it into a fixed-size heap-allocated buffer. This discrepancy between the expected data size and the actual buffer allocation results in an out-of-bounds write operation, overwriting adjacent memory locations on the heap.\nThe attack flow begins when the jhead application parses a maliciously engineered image file. Upon encountering the WebP EXIF data, the parser passes the GPS coordinates to the vulnerable ProcessGpsInfo function. By manipulating the values associated with TAG_GPS_LAT or TAG_GPS_LONG, the attacker triggers the heap overflow. Because this is a heap-based corruption, an attacker may be able to manipulate heap metadata or adjacent objects to achieve arbitrary code execution, depending on the heap allocator's implementation and the state of the process memory.\nExploitation requires the attacker to have local access to execute jhead against a malicious file. While the vulnerability does not require remote network exposure, it poses a significant threat in environments where jhead is used as a backend library or utility for web services or automated image processing pipelines. If a web application uses jhead to extract metadata from user-uploaded images, a remote attacker could potentially reach this vulnerable code path indirectly. The payload behavior typically involves the injection of oversized or unexpected data structures into the heap, which, if crafted correctly, can hijack the application's control flow. Post-exploitation impact ranges from a Denial of Service (DoS) due to process termination to potential system compromise if the attacker successfully redirects execution flow to controlled shellcode."
}