Code injection in ExifTool
Priority CRITICAL 91Exploited in the wildCWE-94Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-94.
Summary
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
Why it matters now
Exploitation Active In CISA KEV since 2021-11-17CISA due date 2021-12-01
EPSS 0.99981 99th percentileScored 2026-11-07
Public exploit Yes 5 exploit referencesTagged by NVD
Fix Fixed ExifTool (ExifTool): 12.24
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ExifTool | ExifTool | 7.44 to before 12.24 | 12.24 | Patch available | CNA |
- ExifTool VendorExifTool Affected 7.44 to before 12.24 Fixed in 12.24 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:exiftool_project:exiftool:*:*:*:*:*:*:*:* | 7.44 to before 12.24 | Vulnerable | Exiftool Project |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
- cpe:2.3:a:exiftool_project:exiftool:*:*:*:*:*:*:*:* Versions 7.44 to before 12.24 Vulnerable ·Exiftool Project
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA ExifTool (ExifTool) Fixed in 12.24
Vendor assessments
Timeline
- 2021-11-17 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2021-22204
- 2026-10-03 Alias added: GHSA-9377-7hwr-p4w6
References
Exploit 5
- https://hackerone.com/reports/1154542
- http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html
- http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html
- http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html
Advisory 8
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json
- DSA-4910
- FEDORA-2021-de850ed71e
- FEDORA-2021-e3d8833d36
- FEDORA-2021-88d24aa32b
- [oss-security] 20210509 [CVE-2021-22204] ExifTool - Arbitrary code execution in the DjVu module when parsing a malicious image
- [oss-security] 20210510 Re: [CVE-2021-22204] ExifTool - Arbitrary code execution in the DjVu module when parsing a malicious image
- [debian-lts-announce] 20210516 [SECURITY] [DLA 2663-1] libimage-exiftool-perl security update
More Perl vulnerabilities
- TI-2022-24100 In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead… CVSS 3.1CRITICAL 9.8
- TI-2012-05140 The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl… CVSS 2.0HIGH 7.5
- TI-2025-27303 Untrusted search path in perl CVSS 3.1MEDIUM 5.9
- TI-2018-12932 Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular… CVSS 3.0CRITICAL 9.8
- TI-2018-12931 Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular… CVSS 3.0CRITICAL 9.8
- TI-2018-05049 Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2021-22204 · CVE Program
- CVE-2021-22204 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-9377-7hwr-p4w6 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-22204 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences