CVE-2021-22204

high

Description

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

References

https://www.debian.org/security/2021/dsa-4910

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/

https://lists.debian.org/debian-lts-announce/2021/05/msg00018.html

https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json

http://www.openwall.com/lists/oss-security/2021/05/10/5

http://www.openwall.com/lists/oss-security/2021/05/09/1

https://securelist.com/exiftool-compromise-mac/119866/

https://thehackernews.com/2025/04/how-breaches-start-breaking-down-5-real.html

https://github.com/Mohamed-Amine-Slama/AllPayloads-For-Web-CVEs

https://github.com/K3ysTr0K3R/CVE-2021-22205

https://github.com/d4ytox/CVE-2021-22204

https://github.com/TeddyEngel/CVE-2021-22204

https://github.com/Roronoawjd/CVE-2021-22204

https://github.com/sameep0/CVE-2021-22204

https://github.com/cc3305/CVEAllTheThings

https://github.com/convisolabs/CVE-2021-22204-exiftool

https://github.com/advisories/GHSA-4whq-r978-2x68

https://github.com/star-sg/CVE

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22204

https://hackerone.com/reports/1154542

https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800

http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html

http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html

http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html

http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html

Details

Source: Mitre, NVD

Published: 2021-04-23

Updated: 2026-06-17

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 7.8

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.99981

Detections

Analytics