CVE-2021-22204 ExifTool Remote Code Execution

What is CVE-2021-22204?

CVE-2021-22204 is a medium-severity code injection vulnerability in Debian Debian Linux, published on 23 Apr 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

Weakness: CWE-94

Which versions are affected by CVE-2021-22204?

It affects 3 products.

Products include Debian Debian Linux, Exiftool Project Exiftool, Fedoraproject Fedora.

How do I fix CVE-2021-22204?

Upgrade to a fixed version. US federal agencies must fix it by 1 Dec 2021.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2021-22204 being exploited?

Yes. Attackers have exploited CVE-2021-22204 in the wild since at least 17 Nov 2021.

Public exploit code: 2 Metasploit modules, 1 Exploit-DB entry and 16 proofs of concept on GitHub.

Other vulnerabilities in Debian Debian Linux

• CVE-2015-3306 ProFTPD Improper Access Control Exploited Critical 10.0
• CVE-2025-49113 RoundCube Webmail Deserialization of Untrusted Data Exploited Critical 9.9
• CVE-2026-24061 GNU InetUtils Argument Injection Exploited Critical 9.8
• CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Exploited Critical 9.8
• CVE-2024-9680 Mozilla Firefox Use-After-Free Exploited Critical 9.8

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2021-22204, DLA-2663-1, DSA-4910-1, GHSA-9377-7hwr-p4w6, MGASA-2021-0259, UBUNTU-CVE-2021-22204 and 3 more.