Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing t
ExifTool versions 7.44 up to 12.24 are affected when processing a malformed DjVu file. The fix is in 12.24.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 12.24
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
ExifTool, a widely used utility for reading and writing metadata in image and media files, is affected when it processes DjVu-format files. A specially crafted malicious image can cause it to run arbitrary code on the system where it is parsing that file.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- ExifTool ExifTool
From 7.44 · fixed in 12.24
References 14
GitHub · exiftool/exiftool
hackerone.com
debian.org
lists.fedoraproject.org
packetstormsecurity.com
lists.debian.org
Questions about CVE-2021-22204
What does this mean?
The bug is improper handling of user data in the DjVu file format, which allows arbitrary code execution when ExifTool parses a malformed DjVu file.Source: lists.debian.org
Am I affected, and how do I check?
Versions from 7.44 up to but not including 12.24 are affected, and the issue concerns processing DjVu files. To check a version, run exiftool -ver.Source: lists.debian.org
What should I do about it?
Upgrade to ExifTool 12.24 or later. The advisory also cites Debian package version 11.16-1+deb10u1 as a fixed build.Source: lists.debian.org
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2021-11-17, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data