CVE-2021-22204

KEVExifTool Remote Code Execution Vulnerability

Description

Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

CVSS 3.1 vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

PublishedApr 23, 2021

Last modifiedJun 17, 2026

Added to KEVNov 17, 2021

Remediation dueDec 1, 2021

References

packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.htmlExploitThird Party Advisory
packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.htmlExploitThird Party Advisory
packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.htmlExploitThird Party Advisory
packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.htmlExploitThird Party Advisory
openwall.com/lists/oss-security/2021/05/09/1Mailing ListThird Party Advisory
openwall.com/lists/oss-security/2021/05/10/5Mailing ListThird Party Advisory
github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031Patch
gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.jsonThird Party Advisory
hackerone.com/reports/1154542ExploitIssue Tracking
lists.debian.org/debian-lts-announce/2021/05/msg00018.htmlMailing ListThird Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/Release Notes
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV/Release Notes

0 recent articles mention this CVE

Risk assessment · High

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1791 days
CVSS: 6.8 MEDIUM
EPSS (30-day exploit probability): 100.0% · top 1% of all CVEs
Weakness: CWE-94
Preconditions: No privileges and no user interaction

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.