The vulnerability resides in Exiftool, affecting versions 13.53 and earlier. The Process_mrld routine in GM.pm processes the –ee parameter unsafely, allowing an attacker who can run Exiftool locally to inject arbitrary code. This code injection can lead to local execution of attacker supplied commands, enabling privilege escalation or full system compromise. The flaw is classified as CWE‑74 and CWE‑94.

Targeted systems are those running Exiftool for JPEG/QuickTime/MOV/MP4 media processing. All installations of Exiftool up to version 13.53, inclusive, are vulnerable. The patch was introduced in commit 5a8b6b6ead12b39e3f32f978a4efd0233facbb01 and is incorporated in version 13.54.

The CVSS score of 4.8 reflects a moderate severity assessment, and no EPSS value is available, indicating limited data on current exploitation patterns. Since the vulnerability requires a local attacker with some degree of user privileges, the attack vector is local execution rather than remote. The vulnerability is not listed in the CISA KEV catalog, further suggesting it has not been observed in the wild at large. Nonetheless, any system that permits local users to invoke Exiftool with untrusted input should treat the flaw as a potential threat.