CVE-2026-90682
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A security vulnerability was detected in Matthias-Wandel jhead up to 3.3. It affects the ProcessGpsInfo function in gpsinfo.c of the WebP EXIF Handler component. Manipulation of the TAG_GPS_LAT/TAG_GPS_LONG arguments leads to a heap-based buffer overflow. The attack requires local access and the exploit has been publicly disclosed.
Risk Assessment
A local attacker can exploit the buffer overflow to execute arbitrary code or crash the application. Since the exploit is public, the risk of exploitation is real.
Recommendation
Avoid processing untrusted WebP files with GPS data until a fix is released. Monitor the jhead project for updates and apply them immediately once available.
Other vulnerabilities in jhead
Original NVD description (English source)
A security vulnerability has been detected in Matthias-Wandel jhead up to 3.3. This impacts the function ProcessGpsInfo of the file gpsinfo.c of the component WebP EXIF Handler. Such manipulation of the argument TAG_GPS_LAT/TAG_GPS_LONG leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS