CVE-2023-50671

What it actually does

Heap-based buffer overflow via uncontrolled snprintf write of 28 bytes in nikon_prop1 during EXIF tag parsing, enabling memory corruption and potential arbitrary code execution.

Why it matters to the business

Attackers can execute code on systems that parse untrusted image files containing Nikon EXIF data, leading to potential compromise of user workstations or servers that process such media.

How an attack unfolds

An attacker creates a crafted image file embedding malicious Nikon EXIF metadata designed to trigger the snprintf overflow; when a victim processes the file with an affected exiftags binary or library, the overflow occurs during nikon_prop1 parsing and can be leveraged for code execution.

How to fix it

Upgrade to a patched version of exiftags that corrects the snprintf usage in nikon.c; if no official update exists, replace the library with a maintained alternative or remove Nikon-specific parsing functionality.

How to confirm the fix worked

Rebuild exiftags with address sanitizer or similar memory safety tooling and re-test against the original proof-of-concept input; confirm absence of the 28-byte write outside allocated bounds.

Typical attack path

1. Craft malicious image containing oversized or malformed Nikon EXIF tags
2. Deliver image to target via email, web, or file share
3. Victim opens or processes the image with a tool linked to exiftags
4. nikon_prop1 performs snprintf write beyond intended buffer
5. Attacker-controlled data overwrites heap structures to achieve code execution

How to detect it

Search process execution logs and file access records for invocations of exiftags binaries against files with Nikon maker notes; examine crash dumps or heap logs for abnormal writes originating from nikon_prop1.

What your security team should do

• Inventory all systems and applications that invoke exiftags or ship it as a dependency
• Block or sandbox processing of untrusted image files on high-risk endpoints until remediation is applied
• Monitor upstream for any community or vendor patches addressing the nikon.c buffer handling