CVE-2011-2747: Google Picasa

High severity, CVSS 9.3. EPSS: 4.3% chance of exploitation in the next 30 days.

Google Picasa before 3.6 Build 105.67 does not properly handle invalid properties in JPEG images, which allows remote attackers to execute arbitrary code via a crafted image file.

Affected products

• Google Picasa: up to and including 3.6_build_105.65; version 3.5 only; version 3.5_build_79.67 only; version 3.5_build_79.69 only; version 3.5_build_79.74 only; version 3.5_build_79.81 only; …

Published 2011-07-28. Last modified 2026-06-16.