CVE-2011-2747

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2011-07-28 · updated 2026-06-16
Weakness: CWE-94

Description

Google Picasa before 3.6 Build 105.67 does not properly handle invalid properties in JPEG images, which allows remote attackers to execute arbitrary code via a crafted image file.

Affected products

Google Picasa: through 3.6_build_105.65; 3.5, 3.5_build_79.67, 3.5_build_79.69, 3.5_build_79.74, 3.5_build_79.81, 3.5_build_95.18 (+3)

References

http://osvdb.org/73980
http://picasa.google.com/support/bin/static.py?hl=en&page=release_notes.cs&from=53209&rd=1
http://secunia.com/advisories/45293
http://www.microsoft.com/technet/security/advisory/msvr11-008.mspx
https://exchange.xforce.ibmcloud.com/vulnerabilities/68735
http://osvdb.org/73980
http://picasa.google.com/support/bin/static.py?hl=en&page=release_notes.cs&from=53209&rd=1
http://secunia.com/advisories/45293
http://www.microsoft.com/technet/security/advisory/msvr11-008.mspx
https://exchange.xforce.ibmcloud.com/vulnerabilities/68735

Get alerted when CVE-2011-2747 or the next vulnerability affects your stack