CVE-2021-22204

🔥 Known Exploited (CISA KEV)MEDIUM

6.8

CVSS Severity Score

EPSS Score35.0210%

EPSS Percentile96.76th

Published2021-04-23

Last Modified2025-11-03

Data SourcesNVDCISA KEVFIRST.org EPSS

Vulnerability Description

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

Affected Platforms (CPE)

📦

Exiftool Project

Exiftool

>= 7.44 and < 12.24

💻

Debian

Debian Linux

= 9.0= 10.0

💻

Fedoraproject

Fedora

= 32= 33= 34

References & Advisories

🔗 http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html

🔗 http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html

🔗 http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html

🔗 http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html

🔗 http://www.openwall.com/lists/oss-security/2021/05/09/1

🔗 http://www.openwall.com/lists/oss-security/2021/05/10/5

🔗 https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800

🔗 https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json