ACTIVELY EXPLOITED
CVE-2021-22204: ExifTool Remote Code Execution Vulnerability
| Vendor | Perl |
|---|---|
| Product | Exiftool |
| Actively exploited | Yes |
| Added to CISA KEV | 17 Nov 2021 |
| CISA federal deadline | 1 Dec 2021 |
| Weakness (CWE) | CWE-95 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
SOURCES
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.