VYPR
← All advisories
High severity7.8NVD Advisory· Published Jan 2, 2019· Updated Jun 17, 2026

CVE-2018-20211

CVE-2018-20211

Description

ExifTool 8.32 allows local users to gain privileges by creating a %TEMP%\par-%username%\cache-exiftool-8.32 folder with a victim's username, and then copying a Trojan horse ws32_32.dll file into this new folder, aka DLL Hijacking. NOTE: 8.32 is an obsolete version from 2010 (9.x was released starting in 2012, and 10.x was released starting in 2015).

Affected products

3
  • Exiftool/Exiftoolinferred3 versions
    = 8.32+ 2 more
    • (no CPE)range: = 8.32
    • cpe:2.3:a:exiftool_project:exiftool:8.32:*:*:*:*:*:*:*
    • (no CPE)range: = 8.32

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.

CVE-2018-20211 · High · VYPR