CVE-2026-7580: ExifTool Code Injection RCE Vulnerability

CVE-2026-7580 Overview

CVE-2026-7580 is a code injection vulnerability [CWE-74] affecting ExifTool versions up to 13.53. The flaw resides in the Process_mrld function within lib/Image/ExifTool/GM.pm, which handles JPEG, QuickTime, MOV, and MP4 metadata parsing. An attacker can manipulate input processed via the -ee (extract embedded) argument to trigger code injection. Exploitation requires local access and low-privilege authentication. ExifTool maintainers addressed the issue in version 13.54 with commit 5a8b6b6ead12b39e3f32f978a4efd0233facbb01. The source-level fix comment notes the change was applied "just to be safe, probably never happen," indicating the path is narrow but defensible programming was applied.

Critical Impact
Local attackers with low privileges can trigger code injection through crafted media files when ExifTool is invoked with the -ee flag, potentially executing unintended logic in the Perl runtime context.

Affected Products

ExifTool versions up to and including 13.53
ExifTool component lib/Image/ExifTool/GM.pm (Process_mrld function)
Workflows invoking ExifTool with the -ee argument on JPEG, QuickTime, MOV, or MP4 files

Discovery Timeline

2026-05-01 - CVE-2026-7580 published to NVD
2026-05-01 - Last updated in NVD database
April 1, 2026 - ExifTool 13.54 released with the patch

Technical Details for CVE-2026-7580

Vulnerability Analysis

The vulnerability is classified as Improper Neutralization of Special Elements in Output Used by a Downstream Component [CWE-74]. ExifTool is a Perl-based metadata reader and writer used in media-processing pipelines, asset management, and digital forensics workflows. The Process_mrld routine in lib/Image/ExifTool/GM.pm parses an mrld data structure encountered in QuickTime/MOV/MP4 containers and certain JPEG segments. When ExifTool is run with the -ee (extract embedded) flag, this routine processes additional embedded streams that would normally be ignored. The combination of attacker-controlled embedded data and insufficient neutralization in Process_mrld enables code injection into a downstream component.

Root Cause

The root cause is improper handling of values parsed from the mrld structure before they reach a downstream evaluator. The maintainer's note in the patch ("just to be safe, probably never happen") indicates the unsafe code path is reachable only under specific conditions, but the function did not constrain or sanitize the values rigorously enough to guarantee safety. Without that defense, a crafted media file can introduce content that influences execution semantics rather than being treated as inert data.

Attack Vector

Exploitation is local. An attacker must convince a user or automated pipeline to run ExifTool with the -ee flag against a malicious JPEG, MOV, MP4, or QuickTime file. Common scenarios include shared file servers, ingestion pipelines that automatically extract embedded metadata, and forensic tooling. The attacker requires low privileges to place or supply the file. Because -ee is opt-in, deployments that never use embedded extraction are not exposed.

text

# Patch reference - ExifTool Changes file (version 13.54)
Apr. 1, 2026 - Version 13.54

  - Added a new PentaxModelID
  - Decode timed GPS from another DJI model
  - Decode more information from Apple live photo videos
  - Updated DICOM tags to 2026b specification
  - Patched potential security issue
  - Patched to fix failed tests on Windows (was a bug in the tests)
  - Patched to allow spaces in Windows title strings

# Source: https://github.com/exiftool/exiftool/commit/5a8b6b6ead12b39e3f32f978a4efd0233facbb01

Detection Methods for CVE-2026-7580

Indicators of Compromise

Execution of exiftool binaries reporting a -v version of 13.53 or earlier on production systems
Process command lines combining exiftool with the -ee argument and untrusted file paths
Unexpected child processes spawned by exiftool or perl during media ingestion jobs

Detection Strategies

Inventory all hosts, container images, and CI/CD runners that ship ExifTool, and compare installed versions against 13.54 using package managers or exiftool -ver.
Hunt for invocations of ExifTool with the -ee flag against files originating from external or low-trust locations such as upload directories or email attachments.
Review media-processing services and asset pipelines for embedded extraction usage, and capture process telemetry around those jobs for anomaly review.

Monitoring Recommendations

Forward process creation events for exiftool and perl interpreters to a centralized logging or SIEM platform for retrospective analysis.
Alert on ExifTool processes that spawn shells, network utilities, or file-modification tools outside of expected pipeline behavior.
Track file-write events that follow ExifTool execution against untrusted media to detect post-exploitation persistence attempts.

How to Mitigate CVE-2026-7580

Immediate Actions Required

Upgrade ExifTool to version 13.54 or later on every endpoint, server, and container image where it is installed.
Audit automation that invokes ExifTool with -ee and disable the flag where embedded extraction is not required.
Restrict ExifTool execution to least-privileged service accounts and isolate media-processing jobs from sensitive resources.

Patch Information

The upstream fix is available in ExifTool Release 13.54 and tracked in commit 5a8b6b6ead12b39e3f32f978a4efd0233facbb01. The change updates lib/Image/ExifTool/GM.pm so that Process_mrld no longer permits values that could be interpreted by a downstream component. Additional context is available in the GitHub Commit Diff and the VulDB #360421 entry.

Workarounds

Avoid the -ee flag when processing untrusted JPEG, QuickTime, MOV, or MP4 files until the upgrade is deployed.
Run ExifTool inside sandboxed environments such as containers with read-only filesystems, seccomp profiles, or dedicated low-privilege users.
Validate and quarantine inbound media files, including size and type checks, before passing them to ExifTool ingestion jobs.

bash

# Verify installed ExifTool version and upgrade where needed
exiftool -ver

# Debian/Ubuntu - upgrade via package manager
sudo apt-get update && sudo apt-get install --only-upgrade libimage-exiftool-perl

# Manual upgrade from upstream tarball (replace path as appropriate)
curl -L -o /tmp/exiftool-13.54.tar.gz \
  https://github.com/exiftool/exiftool/archive/refs/tags/13.54.tar.gz
tar -xzf /tmp/exiftool-13.54.tar.gz -C /opt/

# Confirm the upgrade
/opt/exiftool-13.54/exiftool -ver