Executive brief
jhead is a command-line tool for reading and manipulating EXIF metadata in JPEG and WebP image files. A heap buffer over-read vulnerability in the EXIF parser allows an attacker with a malformed image file to trigger an out-of-bounds memory read, potentially exposing sensitive data or causing the application to crash.
Technical details
The vulnerability is a heap buffer over-read in the Get16u function (exif.c:331) that occurs when processing malformed EXIF chunks in WebP files. When a malicious sub-IFD (Image File Directory) link points DirStart to within 1 byte of the buffer boundary, a subsequent Get16u(DirStart) call reads 2 bytes past the allocated region. The existing bounds check at exif.c:510 does not guard the Get16u(DirStart) read itself, resulting in a 1-byte out-of-bounds read. The attack requires local access and a specially crafted WebP file; exploitation can lead to information disclosure or denial of service. No patch has been released as of the advisory date, and the project maintainer has not yet responded to the issue report.
Affected products
- Matthias-Wandel jhead up to 3.3
Timeline
- 2026-07-27: disclosed: Issue #98 reported on GitHub
- 2026-09-14: advisory: CVE-2026-90681 published