NetSight
IP …
medium6.8Known exploitedPublic exploit code

CVE-2021-22204

ExifTool Remote Code Execution Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-17. Federal due date: 2021-12-01.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

Affected products

VendorProductAffected versions
Exiftool ProjectExiftool
from 7.44 before 12.24
DebianDebian Linux
Versions 9.0, 10.0
FedoraprojectFedora
Versions 32, 33, 34

Weakness classification

CWE-94

References