CVE-2021-22204 — ExifTool Remote Code Execution Vulnerability

provenance: imported · CVE: CVE-2021-22204

CVE-2021-22204: ExifTool Remote Code Execution Vulnerability

CISA Known Exploited Vulnerability (KEV)


Vendor / project	Perl
Product	Exiftool
Date added	2021-11-17
Due date	2021-12-01
Ransomware campaign use	Unknown

Description

Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

Required action (CISA)

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2021-22204

References

NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-22204
KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog