Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-90682: jhead up to 3.3 can overflow memory via GPS data

CVE-2026-90682 · published 1 month ago

Summary

The jhead program (versions up to 3.3) can mishandle specially crafted GPS latitude or longitude information, causing a memory overflow. This could let someone with local access cause the program to crash or behave unexpectedly. Apply the latest update or replace the affected version to eliminate the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	matthias-wandel	jhead	3.0
Ubuntu:Pro:14.04:LTS	canonical	jhead	All versions
Debian:12	debian	jhead	All versions

Original advisory text

A security vulnerability has been detected in Matthias-Wandel jhead up to 3.3. This impacts the function ProcessGpsInfo of the file gpsinfo.c of the component WebP EXIF Handler. Such manipulation of the argument TAG_GPS_LAT/TAG_GPS_LONG leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

References

https://github.com/Matthias-Wandel/jhead/issues/99 Third Party Advisory
https://github.com/Matthias-Wandel/jhead/ Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2026-90682 Vendor Advisory
https://ubuntu.com/security/CVE-2026-90682 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-90682 Third Party Advisory
https://vuldb.com/submit/914948 Third Party Advisory
https://vuldb.com/vuln/403215/cti Third Party Advisory
https://vuldb.com/vuln/403215 Third Party Advisory
https://github.com/user-attachments/files/30397094/poc.zip Third Party Advisory
https://vuldb.com/cve/CVE-2026-90682 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.9 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-122Heap-based Buffer Overflow

CWE-119Buffer Overflow

Timeline

Published14 Sep 2026

Updated26 Oct 2026

First seen14 Sep 2026

Sources

CVE-2026-90682 · NVD

CVE-2026-90682 · MITRE

DEBIAN-CVE-2026-90682 · OSV

UBUNTU-CVE-2026-90682 · OSV

Track software like this

Free during beta