CVE-2015-1362

Exif Pilot 4.7.2 - Buffer Overflow via Long Maker Element in XML File

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2015-1362. PoCs published by Osanda Malith Jayathissa.

AI-analyzed exploit summary This exploit leverages a SEH-based buffer overflow in Exif Pilot 4.7.2 by crafting a malicious XML file. The payload overwrites the SEH handler and triggers arbitrary code execution when the file is imported via the 'Customize 35mm tab' feature.

Description

Buffer overflow in the Customize 35mm tab in Two Pilots Exif Pilot 4.7.2 allows remote attackers to execute arbitrary code via a long string in the maker element in an XML file.

Exploits (1)

exploitdb WORKING POC
by Osanda Malith Jayathissa · rubydoswindows
https://www.exploit-db.com/exploits/35870

This exploit leverages a SEH-based buffer overflow in Exif Pilot 4.7.2 by crafting a malicious XML file. The payload overwrites the SEH handler and triggers arbitrary code execution when the file is imported via the 'Customize 35mm tab' feature.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Exif Pilot version 4.7.2
No auth needed
Prerequisites: Victim must open the malicious XML file in Exif Pilot · Exif Pilot 4.7.2 must be installed on a vulnerable system (e.g., Windows XP SP2)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/35870

Scores

EPSS 0.0831
EPSS Percentile 94.2%

Details

CWE
CWE-119
Status published
Products (1)
two_pilots/exif_pilot 4.7.2
Published Jan 27, 2015
Tracked Since Feb 18, 2026