CVE-2026-90681: Matthias-Wandel jhead EXIF Parsing exif.c Get16u out-of-bounds
A weakness has been identified in Matthias-Wandel jhead up to 3.3. This affects the function Get16u of the file exif.c of the component EXIF Parsing. This manipulation causes out-of-bounds read. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running Matthias-Wandel jhead version 3.3 or earlier are potentially affected when processing EXIF data. Exploitation requires local access and low-level privileges.
What impact can exploitation have?
The reported issue is an out-of-bounds read in EXIF parsing that can cause an availability impact. The supplied vector indicates no confidentiality or integrity impact.
Is public exploit information available?
Yes. The vulnerability data states that an exploit has been made publicly available and could be used in attacks.
Is a vendor fix available?
No fix is identified in the available data. The project was reportedly notified through an issue report but had not responded at the time of publication.