CVE-2013-5358
Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 allows remote attackers to trigger memory...
Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 allows remote attackers to trigger memory corruption via a crafted TIFF tag, as demonstrated using a KDC file with a DSLR-A100 model and certain sequences of tags.
Exploit likelihood
What each source reports
NVD Score used
Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 allows remote attackers to trigger memory corruption via a crafted TIFF tag, as demonstrated using a KDC file with a DSLR-A100 model and certain sequences of tags.
- Record
CVE-2013-5358- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 allows remote attackers to trigger memory corruption via a crafted TIFF tag, as demonstrated using a KDC file with a DSLR-A100 model and certain sequences of tags.
- Record
CVE-2013-5358- Updated
- 2026-11-02
EUVDEUVD-2013-5198 No score
Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 allows remote attackers to trigger memory corruption via a crafted TIFF tag, as demonstrated using a KDC file with a DSLR-A100 model and certain sequences of tags.
- Record
EUVD-2013-5198- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5r5q-gm8c-56h4 No score
Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 allows remote attackers to trigger memory...
Picasa3.exe in Google Picasa before 3.9.0 Build 137.69 allows remote attackers to trigger memory corruption via a crafted TIFF tag, as demonstrated using a KDC file with a DSLR-A100 model and certain sequences of tags.
- Record
GHSA-5r5q-gm8c-56h4- Weakness
- CWE-119
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-5358 is a high vulnerability (CVSS 7.5) in Google Picasa, published January 9, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.27%, the 69th percentile. No source names a fixed version.