A JPEG that owns your Mac

Walked ExifTool's macOS command-injection blind spot end to end — how a metadata parser quietly became a code-execution path (CVE-2026-3102).