CVE-2026-90682: jhead WebP EXIF Handler Buffer Overflow

CVE-2026-90682 Overview

CVE-2026-90682 is a heap-based buffer overflow in Matthias-Wandel jhead versions up to 3.3. The flaw resides in the ProcessGpsInfo function within gpsinfo.c, part of the WebP EXIF Handler component. Manipulation of the TAG_GPS_LAT and TAG_GPS_LONG arguments triggers the overflow condition. The vulnerability requires local access and low-privileged authentication to exploit. A public proof-of-concept has been disclosed, but the project maintainer has not yet responded to the upstream issue report. The weakness is classified under [CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer].

Critical Impact
Local attackers can trigger a heap-based buffer overflow when jhead parses a crafted WebP image containing malicious GPS EXIF tags, potentially corrupting process memory.

Affected Products

Matthias-Wandel jhead versions up to and including 3.3
WebP EXIF Handler component (gpsinfo.c)
Downstream tools and pipelines that embed jhead for image metadata processing

Discovery Timeline

2026-09-14 - CVE-2026-90682 published to the National Vulnerability Database
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90682

Vulnerability Analysis

The vulnerability exists in the ProcessGpsInfo function in gpsinfo.c, which handles GPS metadata extracted from WebP image EXIF blocks. When jhead parses the TAG_GPS_LAT and TAG_GPS_LONG tags, insufficient bounds checking on the tag data allows the routine to write past the boundaries of a heap-allocated buffer. Because the affected code path only requires local file access and low privileges, an attacker who can place a crafted WebP file on the target system and induce jhead to process it can trigger memory corruption. The vulnerability is limited to local attack scenarios, which constrains its practical exploitation surface compared to network-facing flaws.

Root Cause

The root cause is improper restriction of operations within the bounds of a memory buffer [CWE-119]. The ProcessGpsInfo function does not adequately validate the length or structure of GPS latitude and longitude tag data extracted from WebP EXIF segments before copying it into a heap buffer. Attacker-controlled tag values can exceed the allocated buffer size, corrupting adjacent heap metadata or memory regions.

Attack Vector

Exploitation requires local access to a system running a vulnerable jhead build and the ability to supply a malicious WebP file. An attacker crafts a WebP image with oversized or malformed TAG_GPS_LAT and TAG_GPS_LONG EXIF entries. When a user or automated pipeline runs jhead against the file, the overflow occurs. A public proof-of-concept archive has been published through the project's GitHub issue tracker, referenced in GitHub jhead Issue #99 and the VulDB CVE-2026-90682 entry.

No verified code examples are available. See the linked references for the disclosed proof-of-concept and technical details.

Detection Methods for CVE-2026-90682

Indicators of Compromise

Unexpected crashes, aborts, or segmentation faults from jhead processes when handling WebP images.
Presence of WebP files with malformed or oversized GPS EXIF tags (TAG_GPS_LAT, TAG_GPS_LONG) in user upload or ingest directories.
Heap corruption warnings from allocator instrumentation such as glibc malloc_check or AddressSanitizer during image processing.

Detection Strategies

Inventory systems and container images for jhead binaries at version 3.3 or earlier using software composition analysis tools.
Run vulnerable jhead builds under AddressSanitizer in test environments to confirm exposure and validate patched versions.
Inspect ingested WebP files with an EXIF parser to flag entries where GPS latitude or longitude fields exceed the standard rational-value size.

Monitoring Recommendations

Alert on abnormal termination of image-processing workers, cron jobs, or CI/CD steps that invoke jhead.
Log and monitor invocations of jhead against files sourced from untrusted or user-supplied inputs.
Track upstream activity on the jhead GitHub repository for the appearance of a fix commit or tagged release.

How to Mitigate CVE-2026-90682

Immediate Actions Required

Restrict jhead execution to trusted, non-attacker-controlled files until a vendor patch is available.
Remove or disable jhead from automated pipelines that process user-supplied WebP images.
Enforce least-privilege execution so that any exploitation is contained to a low-privileged account.

Patch Information

At the time of NVD publication, no vendor patch has been released. The upstream project was notified through GitHub jhead Issue #99 but has not responded. Monitor the Matthias-Wandel jhead repository for a fixed release and rebuild any downstream packages once a patched version is published.

Workarounds

Strip or sanitize EXIF metadata from incoming WebP files using a hardened image-processing library before passing them to jhead.
Sandbox jhead invocations with tools such as firejail, bubblewrap, or seccomp filters to limit the impact of memory corruption.
Replace jhead in critical workflows with an actively maintained metadata parser until the upstream fix is available.

bash

# Configuration example: sandbox jhead with firejail and reject WebP inputs
firejail --noprofile --private --seccomp --net=none \
  /usr/bin/jhead "$INPUT_FILE"

# Optional: reject WebP files at ingest to avoid the vulnerable code path
case "$INPUT_FILE" in
  *.webp|*.WEBP)
    echo "WebP input rejected pending CVE-2026-90682 patch" >&2
    exit 1
    ;;
esac