CVE-2021-22204

ExifTool

Published 23 Apr 2021 · updated 17 Jun 2026 · Analyzed

7.8 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 17 Nov 2021, with a remediation deadline of 1 Dec 2021 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

References

packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html · Exploit, Third Party Advisory, VDB Entry
packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html · Exploit, Third Party Advisory, VDB Entry
packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html · Exploit, Third Party Advisory, VDB Entry
packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html · Exploit, Third Party Advisory, VDB Entry
www.openwall.com/lists/oss-security/2021/05/09/1 · Mailing List, Third Party Advisory
www.openwall.com/lists/oss-security/2021/05/10/5 · Mailing List, Third Party Advisory
github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800 · Patch
gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json · Third Party Advisory
hackerone.com/reports/1154542 · Exploit, Issue Tracking, Third Party Advisory
lists.debian.org/debian-lts-announce/2021/05/msg00018.html · Mailing List, Third Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/ · Release Notes
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV/ · Release Notes
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6/ · Release Notes
www.debian.org/security/2021/dsa-4910 · Mailing List, Third Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22204 · US Government Resource