Loading story…
Kaspersky GReAT disclosed CVE-2026-3102, a command injection flaw in ExifTool that can let a malicious image trigger arbitrary shell commands on macOS. The bug affects ExifTool 13.49 and earlier and was fixed in 13.50. According to the report, the issue lies in the SetMacOSTags function, where an unsanitized date value can reach a system() call that invokes /usr/bin/setfile, allowing shell interpretation of attacker-controlled metadata.
Exploitation requires a crafted workflow in which ExifTool is run with the -n flag, bypassing PrintConvInv date sanitization, and the -tagsFromFile feature is used to copy a malicious value from a permissive source tag such as DateTimeOriginal into FileCreateDate. The vulnerable path is specific to macOS, but successful exploitation can fully compromise the user account processing the image. The February patch replaced string-based command construction with argument-list execution and added a wrapper to preserve prior I/O redirection behavior while removing the shell injection risk.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Kaspersky GReAT publicly disclosed CVE-2026-3102, a command injection vulnerability in ExifTool version 13.49 and earlier on macOS. The flaw allows arbitrary shell command execution when attacker-controlled metadata is processed via SetMacOSTags, particularly when ExifTool is used with the -n flag and -tagsFromFile.
ExifTool fixed CVE-2026-3102 in February 2026 with the release of version 13.50. The patch removed shell-interpreted string command construction in the vulnerable macOS SetMacOSTags code path and replaced it with safer argument-list execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurelist.ru
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple disclosed security fixes in **macOS Mojave 10.14.4**, **Security Update 2019-002 High Sierra**, and **Security Update 2019-002 Sierra** that addressed local privilege-escalation flaws in Time Machine diagnostic components. Public research later detailed a command injection bug, tracked as **`CVE-2019-8513`**, affecting macOS **10.12.x through 10.14.3**, where a local user could abuse the `timemachinehelper` XPC service and the `tmdiagnose` utility to execute arbitrary shell commands as **root**. The exploit reportedly worked by crafting a mounted disk image label so shell metacharacters were injected into a command built from `diskutil` output, ultimately yielding a root shell after diagnostic tasks completed. The same research also described a related arbitrary file overwrite issue in XPC helpers, assigned **`CVE-2019-8530`**, and noted it could previously be chained with an older `sudo` timestamp weakness; the findings echoed earlier public work on browser-to-system compromise and underscored how trusted macOS helper services could be leveraged for full system takeover.
Aug 1, 2026
A critical OS command injection flaw tracked as **CVE-2026-14863** allows remote code execution in **FileRun** through its thumbnail generation workflow. The vulnerability affects FileRun up to and including **2026.2.0** and stems from attacker-controlled filenames being passed to `exec()` inside shell double quotes without proper sanitization such as `escapeshellarg()`. By uploading a file with shell command substitution in its name, such as a payload using `$()`, an authenticated attacker can trigger command execution when FileRun invokes thumbnail tools including **ffmpeg**, **ImageMagick**, **vips**, or **stl-thumb**. The issue is classified as **CWE-78** and carries a **CVSS 3.1** vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`. VulnCheck reported that exploitation is possible for any authenticated user with default upload permissions and, in some deployments, may also be reachable before authentication through public file-request weblinks if an attacker knows the token. The official FileRun Docker image reportedly enables the vulnerable thumbnail extractors by default, increasing exposure for containerized deployments. Successful exploitation can provide code execution as **`www-data`**, potentially exposing all files managed by FileRun, database credentials, and broader access to the host server. **FileRun 2026.2.1** is listed as unaffected and contains the fix.
Aug 14, 2026
Apple released security updates for **CVE-2026-86950**, an out-of-bounds write vulnerability in CoreGraphics that can enable arbitrary code execution when a victim processes a maliciously crafted file. Apple said it is aware of reports that the issue may have been used in an “extremely sophisticated” targeted attack against specific individuals running iOS versions before iOS 27; it did not disclose the attackers, victim count, compromise details, or timing. The company fixed the flaw with improved bounds checking in **iOS 26.7.1**, **iPadOS 26.7.1**, **macOS Tahoe 26.7.1**, and **macOS Sequoia 15.8.1**, and credited Meta Product Security with reporting it. Organizations should prioritize deployment across supported Apple endpoints, particularly devices remaining on pre-iOS 27 releases, because exploitation requires only user processing of a malicious file and could result in full confidentiality, integrity, and availability impact.
Oct 1, 2026