CVEvulnerability

CVE-2021-22204

7.8 HIGH Known exploited Published 2021-04-23 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

ExifTool Remote Code Execution Vulnerability — Perl Exiftool

Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

Added to KEV
2021-11-17
Remediation due
2021-12-01
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2021-22204
Status
Analyzed
Published
2021-04-23
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.8 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
CVSS 3.1 ([email protected])
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-94

Description

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

Affected configurations

• exiftool project exiftool (>= 7.44 < 12.24) • debian debian linux 9.0 • debian debian linux 10.0 • fedoraproject fedora 32 • fedoraproject fedora 33 • fedoraproject fedora 34

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

Referenced by CWE · observed example (3)

  • CWE-625 Permissive Regular Expression weakness
  • CWE-94 Improper Control of Generation of Code weakness
  • CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code weakness

References