CVE-2021-22204: ExifTool DjVu parsing flaw allows arbitrary code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with confirmed exploitation, near-maximum EPSS, public exploit code, and yields code execution through ordinary image parsing.

What it is

ExifTool versions 7.44 and later fail to neutralize user data in the DjVu file format, allowing code injection (CWE-94) when a crafted image is parsed. Because ExifTool is widely embedded in upload and metadata pipelines, a malicious image can turn a routine file-processing step into code execution.

Impact

An attacker gains arbitrary code execution in the context of the process parsing the image, with high impact to confidentiality, integrity and availability. This can lead to full compromise of the host or service running ExifTool.

Attack surface

Reached by supplying a malicious DjVu image to ExifTool; the CVSS vector is local (AV:L) with user interaction required (UI:R) and no privileges needed (PR:N). In practice the parsing is often triggered indirectly, for example through an application that runs ExifTool on user-uploaded files.

Exploitation

CISA KEV lists it as exploited with a 2021-12-01 remediation due date, EPSS 30-day probability is 0.99981, and multiple references are tagged Exploit, including public PoCs and GitLab RCE write-ups. No ransomware campaign use is documented.

What to do

• Upgrade ExifTool to a version containing the fix (commit cf0f4e7dcd024ca99615bfd1102a841a25dde031) or later.
• Apply the Debian DSA-4910 and Fedora package updates for bundled ExifTool.
• If patching is delayed, disable or sandbox DjVu parsing and avoid running ExifTool on untrusted images.
• Run ExifTool with least privilege and isolate it from sensitive data and credentials.
• Audit applications that invoke ExifTool on user uploads, including GitLab, and update them.

Detection

• Monitor for ExifTool or Perl child processes spawning unexpected shells or commands after image processing.
• Alert on DjVu files submitted to upload or metadata pipelines, especially from untrusted sources.
• Review process trees and command lines for ExifTool invocations that execute interpreters or download payloads.
• Check for known exploit artifacts in DjVu files and correlate with ExifTool version inventory.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.