CVE Feed

    Dashboard / CVE / CVE-2020-26208

    CVE-2020-26208

    JHEAD is a simple command line tool for displaying and some manipulation of EXIF header data embedded in Jpeg images from digital cameras. In affected versions there is a heap-buffer-overflow on jhead-3.04/jpgfile.c:285 ReadJpegSections. Crafted jpeg images can be provided to the user resulting in a program crash or potentially incorrect exif information retrieval. Users are advised to upgrade. There is no known workaround for this issue.

    Published:Feb 2, 2022
    Last Modified:May 5, 2025
    EPS:Feb 2, 2022
    EPSS Score:0.00082
    CVSS Score:5.3

    Affected Products

    Vendor
    Jhead Project
    Product
    Jhead

    Exploits

    https://bugs.launchpad.net/ubuntu/+source/jhead/+bug/1900821https://github.com/F-ZhaoYang/jhead/security/advisories/GHSA-7pr6-xq4f-qhgchttps://bugs.launchpad.net/ubuntu/+source/jhead/+bug/1900821https://github.com/F-ZhaoYang/jhead/security/advisories/GHSA-7pr6-xq4f-qhgc

    Common Weakness Enumeration

    CWE-787 Out-of-bounds Write

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2025-44906 (CVSS 7.8) — jhead v3.08 was discovered to contain a heap-use-after-free via the ProcessFile function at jhead.c.…
    CVE-2022-28550 (CVSS 9.8) — Matthias-Wandel/jhead jhead 3.06 is vulnerable to Buffer Overflow via shellescape(), jhead.c, jhead. jhead cop…
    CVE-2021-34055 (CVSS 7.8) — jhead 3.06 is vulnerable to Buffer Overflow via exif.c in function Put16u.…
    CVE-2022-41751 (CVSS 7.8) — Jhead 3.06.0.1 allows attackers to execute arbitrary OS commands by placing them in a JPEG filename and then u…
    CVE-2021-28276 (CVSS 7.5) — A Denial of Service vulnerability exists in jhead 3.04 and 3.05 via a wild address read in the ProcessCanonMak…
    CVE-2021-28278 (CVSS 7.8) — A Heap-based Buffer Overflow vulnerability exists in jhead 3.04 and 3.05 via the RemoveSectionType function in…
    CVE-2021-28275 (CVSS 5.5) — A Denial of Service vulnerability exists in jhead 3.04 and 3.05 due to a wild address read in the Get16u funct…
    CVE-2021-28277 (CVSS 7.8) — A Heap-based Buffer Overflow vulnerabilty exists in jhead 3.04 and 3.05 is affected by: Buffer Overflow via th…
    CVE-2021-3496 (CVSS 7.8) — A heap-based buffer overflow was found in jhead in version 3.06 in Get16u() in exif.c when processing a crafte…
    CVE-2020-6625 (CVSS 7.1) — jhead through 3.04 has a heap-based buffer over-read in Get32s when called from ProcessGpsInfo in gpsinfo.c.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High