Live › vulnerability › CVE-2021-22204
Go to dashboardExifTool, a Perl library and command-line tool for reading image metadata, mishandles user data in the DjVu file format from version 7.44 onward. An attacker who gets a crafted image parsed by ExifTool can run arbitrary code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Perl Exiftool | vendor | – | – |
Run exiftool -ver and compare against the fixed release in the vendor advisory; check whether any service parses uploaded images with exiftool.
Upgrade ExifTool to a fixed version per vendor instructions (fixed version not stated in the sources).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2021-22204")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.