The vulnerability resides in exiftool’s SetMacOSTags function within the PNG File Parser. By manipulating the DateTimeOriginal argument, an attacker can inject operating system commands, enabling arbitrary command execution on the host. This flaw permits the execution of shell commands through the exiftool process, compromising the confidentiality, integrity, and availability of the affected system.

Exiftool versions up to and including 13.49 on macOS are affected. The flaw is specifically located in the lib/Image/ExifTool/MacOS.pm component of the PNG File Parser. Upgrading to exiftool 13.50 or later resolves the issue. The affected operating system is macOS, as indicated by the component’s name and the associated CPE.

The vulnerability has a CVSS score of 5.3, reflecting a moderate risk level, and an EPSS score of less than 1%, indicating a low probability of widespread exploitation. It is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, based on the description that the exploit can be carried out remotely and that it has been publicly disclosed. The weakness involves OS command injection, a classic example of CWE-77 and CWE‑78. While the exploitation probability is currently low, the impact of remote command execution warrants prompt attention.