CVE-2026-90681
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A weakness has been identified in Matthias-Wandel jhead up to 3.3. This affects the function Get16u of the file exif.c of the component EXIF Parsing. This manipulation causes out-of-bounds read. The attack requires local access. The exploit has been made available to the public and could be used for attacks.
Risk Assessment
A local attacker can trigger an out-of-bounds read, potentially leading to data disclosure or application crash. The public exploit increases the risk of exploitation.
Recommendation
Monitor the jhead project for a fix — the reported issue has not yet been resolved. Until a patch is released, avoid processing untrusted EXIF files.
Other vulnerabilities in jhead
Original NVD description (English source)
A weakness has been identified in Matthias-Wandel jhead up to 3.3. This affects the function Get16u of the file exif.c of the component EXIF Parsing. This manipulation causes out-of-bounds read. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS