CVE-2020-26208

JHEAD is a simple command line tool for displaying and some manipulation of EXIF header data embedded in Jpeg images from digital cameras. In affected versions there is a heap-buffer-overflow on jhead-3.04/jpgfile.c:285 ReadJpegSections. Crafted jpeg images can be provided to the user resulting in a program crash or potentially incorrect exif information retrieval. Users are advised to upgrade. There is no known workaround for this issue.

• CWE-787
• CWE-787

• https://bugs.launchpad.net/ubuntu/+source/jhead/+bug/1900821Exploit, Third Party Advisory
• https://github.com/F-ZhaoYang/jhead/commit/5186ddcf9e35a7aa0ff0539489a930434a1325f4Patch, Third Party Advisory
• https://github.com/F-ZhaoYang/jhead/security/advisories/GHSA-7pr6-xq4f-qhgcExploit, Third Party Advisory
• https://github.com/Matthias-Wandel/jhead/issues/7Patch, Third Party Advisory
• https://bugs.launchpad.net/ubuntu/+source/jhead/+bug/1900821Exploit, Third Party Advisory
• https://github.com/F-ZhaoYang/jhead/commit/5186ddcf9e35a7aa0ff0539489a930434a1325f4Patch, Third Party Advisory
• https://github.com/F-ZhaoYang/jhead/security/advisories/GHSA-7pr6-xq4f-qhgcExploit, Third Party Advisory
• https://github.com/Matthias-Wandel/jhead/issues/7Patch, Third Party Advisory

Published

Feb 2, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26199Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0…6.7
• CVE-2020-2620Vulnerability in the Enterprise Manager Base Platform produc…6
• CVE-2020-26200A component of Kaspersky custom boot loader allowed loading …6.8
• CVE-2020-26201Askey AP5100W_Dual_SIG_1.01.097 and all prior versions use a…9.8
• CVE-2020-26205Sal is a multi-tenanted reporting dashboard for Munki with t…5.4
• CVE-2020-26207DatabaseSchemaViewer before version 2.7.4.3 is vulnerable to…8
• CVE-2020-2621Vulnerability in the Enterprise Manager Base Platform produc…6
• CVE-2020-26210In BookStack before version 0.30.4, a user with permissions …8.7
• CVE-2020-26211In BookStack before version 0.30.4, a user with permissions …8.7
• CVE-2020-26212GLPI stands for Gestionnaire Libre de Parc Informatique and …6.5
• CVE-2020-26213In teler before version 0.0.1, if you run teler inside a Doc…7.5
• CVE-2020-26214In Alerta before version 8.1.0, users may be able to bypass …9.8