Description
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ExifTool | ExifTool | >=7.44, <12.24 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libimage-exiftool-perl | 12.16+dfsg-2 | — |
| Debian 13 | libimage-exiftool-perl | 12.16+dfsg-2 | — |
| Debian 12 | libimage-exiftool-perl | 12.16+dfsg-2 | — |
| Debian 10 | libimage-exiftool-perl | 11.16-1+deb10u1 | DSA-4910-1 |
| Debian 9 | libimage-exiftool-perl | 10.40-1+deb9u1 | DLA-2663-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libimage-exiftool-perl | 11.88-1ubuntu0.1 | USN-4987-1 |
| Ubuntu 18.04 LTS | libimage-exiftool-perl | 10.80-1ubuntu0.1 | USN-4987-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | libimage-exiftool-perl | 10.10-1ubuntu0.1~esm1 | USN-4987-2 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP2 | perl-Image-ExifTool | 12.25-bp152.4.3.1 | openSUSE-SU-2021:0707-1 |
| SUSE Package Hub 15 SP1 | perl-Image-ExifTool | 12.25-bp152.4.3.1 | openSUSE-SU-2021:0707-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.2 | perl-Image-ExifTool | 12.25-bp152.4.3.1 | openSUSE-SU-2021:0707-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | perl-image-exiftool | 12.24-r0 | — |
| Alpine v3.23 | perl-image-exiftool | 12.24-r0 | — |
| Alpine v3.22 | perl-image-exiftool | 12.24-r0 | — |
| Alpine v3.21 | perl-image-exiftool | 12.24-r0 | — |
| Alpine v3.20 | perl-image-exiftool | 12.24-r0 | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | perl-image-exiftool | 12.24-r0 | — |
| Alpine v3.18 | perl-image-exiftool | 12.24-r0 | — |
| Alpine v3.17 | perl-image-exiftool | 12.24-r0 | — |
| Alpine v3.16 | perl-image-exiftool | 12.24-r0 | — |
| Alpine v3.15 | perl-image-exiftool | 12.24-r0 | — |
| Alpine v3.14 | perl-image-exiftool | 12.24-r0 | — |
| Alpine v3.13 | perl-image-exiftool | 12.24-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 2 modules
-
GitLab Unauthenticated Remote ExifTool Command Injection
exploit/multi/http/gitlab_exif_rce
-
ExifTool DjVu ANT Perl injection
exploit/unix/fileformat/exiftool_djvu_ant_perl_injection
Exploit-DB 1
- ExifTool 12.23 - Arbitrary Code Execution EDB-50911 · local · May 11, 2022
GitHub 17 repositories · most starred shown
-
convisolabs/CVE-2021-22204-exiftool ★ 96 · May 11, 2021
Python exploit for the CVE-2021-22204 vulnerability in Exiftool
-
UNICORDev/exploit-CVE-2021-22204 ★ 55 · Apr 16, 2022
Exploit for CVE-2021-22204 (ExifTool) - Arbitrary Code Execution
-
AssassinUKG/CVE-2021-22204 ★ 28 · Aug 2, 2021
-
se162xg/CVE-2021-22204 ★ 12 · May 12, 2021
exiftool arbitrary code execution vulnerability
-
mr-tuhin/CVE-2021-22204-exiftool ★ 9 · Feb 21, 2022
exiftool exploit
-
bilkoh/POC-CVE-2021-22204 ★ 8 · May 21, 2021
POC for exiftool vuln (CVE-2021-22204).
-
Akash7350/CVE-2021-22204 ★ 4 · May 14, 2023
-
trganda/CVE-2021-22204 ★ 3 · Dec 29, 2021
-
PenTestical/CVE-2021-22204 ★ 3 · Aug 2, 2021
-
ph-arm/CVE-2021-22204-Gitlab ★ 2 · Nov 4, 2021
Modification of gitlab exploit anything under 13.10
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- USN-4987-2 libimage-exiftool-perl vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- DSA-4910-1 libimage-exiftool-perl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2663-1 libimage-exiftool-perl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-4987-1 libimage-exiftool-perl vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2021:0707-1 Security update for perl-Image-ExifTool SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800
- https://hackerone.com/reports/1154542
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json
- DSA-4910 vendor-advisory
- FEDORA-2021-de850ed71e vendor-advisory
- FEDORA-2021-e3d8833d36 vendor-advisory
- FEDORA-2021-88d24aa32b vendor-advisory
- [oss-security] 20210509 [CVE-2021-22204] ExifTool - Arbitrary code execution in the DjVu module when parsing a malicious image mailing-list
- [oss-security] 20210510 Re: [CVE-2021-22204] ExifTool - Arbitrary code execution in the DjVu module when parsing a malicious image mailing-list
- http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html
- [debian-lts-announce] 20210516 [SECURITY] [DLA 2663-1] libimage-exiftool-perl security update mailing-list
- http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html
- http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html