ExifTool Remote Code Execution Vulnerability

HIGH 7.8EXPLOITED (CISA KEV)CVE-2021-22204 · Published 23/04/2021 · updated 17/06/2026

ExifTool Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 17/11/2021. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
exiftool exiftool_project	`≥ 7.44, < 12.24`	`12.24`

Description

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

References

packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html · Exploit
packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html · Exploit
packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html · Exploit
packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html · Exploit
openwall.com/lists/oss-security/2021/05/09/1 · Mailing List
openwall.com/lists/oss-security/2021/05/10/5 · Mailing List
exiftool/exiftool commit cf0f4e7 · Patch
gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json · Third Party Advisory
hackerone.com/reports/1154542 · Exploit
lists.debian.org/debian-lts-announce/2021/05/msg00018.html · Mailing List
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL · Release Notes
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV · Release Notes
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6 · Release Notes
debian.org/security/2021/dsa-4910 · Mailing List
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2021-22204

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free