Do commercial AV suites examine image files (pictures) for potential malware that might be imbedded via steganography? Is this a concern for most?
I deal with a lot of imagery data and am wondering what the risk of exposure is.
Executable code embedded in an image, malware or otherwise, does nothing without an external program capable of acting on it. Granted there have been a few cases in the past exploiting errors in the image processor code to force an overflow into the embedded malware code, but with rare exception, steg content is not a direct threat.
A common practice amongst high security sites is to translate all arriving images to a different format such as JPG to PNG in an isolated handler. You can do this a well if you like, but the threat is miniscule.