CVE-2021-22204
ExifTool Remote Code Execution Vulnerability
Published Apr 23, 2021 · updated Jun 16, 2026 · exiftool project exiftool
Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
Timeline
Detection, updates, and resolution for this record.
Apr 23, 2021 · Catalog
Detected
Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
Nov 17, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Dec 1, 2021 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
Required action
Apply updates per vendor instructions.
CISA due date Dec 1, 2021
Affected
- cpe debian/debian linux10.0
- cpe debian/debian linux9.0
- cpe exiftool project/exiftoolversion unspecified
- cpe fedoraproject/fedora32
- cpe fedoraproject/fedora33
- cpe fedoraproject/fedora34
- vendor Perl Exiftoolversion unspecified
Sources
- CISA KEVCVE-2021-22204
Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
cisa.gov - CVE.orgCVE-2021-22204
Official CVE identifier
cve.org - FIRST EPSSCVE-2021-22204
30-day exploitation probability 100.0%
first.org - Exploit Database50911
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_multi/http/gitlab_exif_rce
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - Metasploit Modulesexploit_unix/fileformat/exiftool_djvu_ant_perl_injection
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2021-22204
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
nvd.nist.gov - Packet Storm Securityhttp://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com