CVE-2026-90681: jhead EXIF Parser Use-After-Free Vulnerability

CVE-2026-90681 Overview

CVE-2026-90681 is an out-of-bounds read vulnerability in Matthias-Wandel jhead up to version 3.3. The flaw resides in the Get16u function inside exif.c, part of the EXIF parsing component. A crafted image file processed by the tool causes the parser to read memory outside allocated bounds. The attack requires local access and low privileges, and a public proof-of-concept exists. As of publication, the upstream project has been notified through an issue report but has not responded.

Critical Impact
Local attackers can trigger an out-of-bounds read in jhead when the tool parses a malicious EXIF header, potentially exposing adjacent memory contents or causing process termination.

Affected Products

Matthias-Wandel jhead versions up to and including 3.3
The exif.c EXIF parsing component
The Get16u function

Discovery Timeline

2026-09-14 - CVE-2026-90681 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90681

Vulnerability Analysis

The vulnerability affects jhead, a command-line utility for reading and manipulating EXIF metadata in JPEG image files. During EXIF parsing, the Get16u helper in exif.c reads a 16-bit unsigned integer from a supplied buffer without verifying that the requested offset lies within the buffer boundary. When a crafted JPEG containing a malformed EXIF header is processed, the parser dereferences memory beyond the allocated region.

The out-of-bounds read [CWE-119] can leak process memory into subsequent parsing decisions or crash the utility. Because jhead is frequently invoked from batch scripts, upload processors, and forensic workflows, malformed input encountered in these pipelines can disrupt automated processing. A public proof-of-concept archive is referenced in the GitHub jhead Issue #98 discussion.

Root Cause

The root cause is missing bounds validation on the read offset supplied to Get16u. The function trusts caller-provided pointers and length values derived from attacker-controlled EXIF tag structures. Without a length check against the parsed segment, the function reads two bytes past the end of the mapped input buffer.

Attack Vector

Exploitation requires local access with low privileges. An attacker supplies a crafted JPEG file that jhead opens for EXIF processing. No user interaction is required beyond invoking the tool against the malicious file. Refer to the VulDB CVE-2026-90681 record for additional context.

No verified code example is available. See the GitHub jhead Repository and the linked issue for technical details of the malformed EXIF structure.

Detection Methods for CVE-2026-90681

Indicators of Compromise

Unexpected termination or segmentation faults from jhead processes during batch image processing
JPEG files with truncated or malformed EXIF segments arriving through upload or ingestion pipelines
Presence of the public proof-of-concept archive referenced in GitHub jhead Issue #98 on user workstations or shared storage

Detection Strategies

Monitor process exit codes and crash reports for jhead invocations in automated media pipelines
Inspect EXIF parser logs for truncated segment warnings or abnormal tag offsets
Scan file repositories for image samples whose EXIF headers reference offsets beyond the file length

Monitoring Recommendations

Enable core-dump collection for jhead on servers that process untrusted images to capture evidence of the out-of-bounds read
Instrument batch jobs with wrapper scripts that log the input filename, exit status, and duration for each jhead call
Aggregate media-processing telemetry into a centralized log platform to correlate anomalous crashes across hosts

How to Mitigate CVE-2026-90681

Immediate Actions Required

Inventory systems that install or invoke jhead and confirm the version in use
Restrict jhead execution to trusted images until a vendor patch is available
Run jhead under a low-privilege service account inside a sandbox or container to contain the impact of a crash

Patch Information

No vendor patch has been released. The upstream maintainer was notified through GitHub jhead Issue #98 but has not responded as of publication. Monitor the GitHub jhead Repository for future commits addressing bounds checking in Get16u.

Workarounds

Pre-validate JPEG inputs with a hardened image parser before passing them to jhead
Execute jhead inside a seccomp-restricted sandbox or a disposable container to limit exposure of adjacent memory
Remove or disable jhead on systems where EXIF processing is not required

bash

# Configuration example: sandbox jhead with firejail and restrict filesystem access
firejail --quiet --private --net=none --seccomp \
    --read-only=/ --read-write=/tmp/jhead-work \
    jhead /tmp/jhead-work/input.jpg