CVE-2023-50671 is a high severity heap based buffer overflow in exiftags 1.01, triggered while parsing Nikon maker notes in a crafted JPEG file. NVD scores it 7.8. The sources do not confirm a fixed release, so stop feeding untrusted images to exiftags and check your distribution for patches.
What's affected
The record names exiftags 1.01 and describes a heap based buffer overflow, a write of size 28, in the nikon_prop1 function in nikon.c, because snprintf can write to an unexpected address. It was published on 2024-01-11.
NVD scores it 7.8 (High) with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The attack vector is local and user interaction is required, which fits a command line tool that someone has to run against a file.
The researcher write up behind the report describes the overflow as found by fuzzing with AddressSanitizer, in a 21 byte heap allocation that snprintf writes past. It does not state a fix or a vendor response. The program's homepage lists 1.01 as the current version, so no newer upstream release is confirmed. Distribution maintainers sometimes backport fixes, so check your package source.
How to check if you're exposed
Look for exiftags in your environment:
which exiftags
exiftags -v
Also search container images and build servers, since photo processing tools tend to be installed once and forgotten. If you use a Linux distribution package, read its security tracker for this CVE to see whether a patched package exists.
The practical exposure depends on where files come from. A photographer running it on their own pictures is a different case from a web service that runs exiftags on uploads from anonymous users. Any workflow that parses images from outside your organization deserves the most attention.
What to do now
- Find every system that has exiftags installed, including containers and CI images.
- Stop using exiftags on files from untrusted sources until a fix is confirmed.
- Check your operating system vendor for a patched package or a backported fix.
- If you must keep using it on untrusted input, run it in a sandbox with no network and limited file access.
- Consider removing the tool where it is no longer needed.
Why it matters
The weakness is an out of bounds write, CWE-787. Image metadata parsers read many small structures laid out by the file itself, and the lengths come from the file. If the code sizes a buffer from one assumption and writes using another, a crafted file can push data past the end of the allocation.
Heap overflows are more dangerous than a simple crash because they can corrupt neighboring objects. Whether that becomes code execution depends on the platform and the allocator, and the sources do not claim it does here.
The record shows no CISA Known Exploited Vulnerabilities listing, and nothing fetched reports exploitation in the wild.
Quick check
Is there a patched exiftags release?
The sources do not confirm one. The project page lists 1.01 as the current version. Check your distribution for a backported fix.
Who is most at risk?
Services that run exiftags automatically on files from outside users, because they open crafted images without anyone reviewing them.
Sources
Last reviewed: 19 October 2026.
