CVE-2026-90682Medium· 5.3▾ TwilightPoC availableA security vulnerability has been detected in Matthias-Wandel jhead up to 3.3. This impacts the function ProcessGpsInfo of the file gpsinfo.c of the component WebP EXIF Handler. Such manipulation of the argument TAG_GPS_LAT/TAG_GPS_LONG …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.1%
Exploit / PoC code exists
A security vulnerability has been detected in Matthias-Wandel jhead up to 3.3. This impacts the function ProcessGpsInfo of the file gpsinfo.c of the component WebP EXIF Handler. Such manipulation of the argument TAG_GPS_LAT/TAG_GPS_LONG leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-90681Low· 3.3A weakness has been identified in Matthias-Wandel jhead up to 3.3
CVE-2026-54559Medium· 6.9PocketSphinx is a small speech recognizer
CVE-2026-87933High· 8.6cJSON: cJSON: Memory corruption via use after free in cJSONUtils_MergePatch (CVE-2026-87933)
CVE-2026-86318Medium· 5.3A flaw has been found in java-json-tools json-patch up to 1.13
CVE-2026-64780Medium· 4.3The issue was addressed with improved checks
CVE-2026-65338Medium· 4.3The issue was addressed with improved memory handling