CVE-2021-22204

CVE-2021-22204 is a code-injection flaw (CWE-95) in ExifTool, a widely used Perl library for reading and writing file metadata: versions 7.44 and later improperly neutralize user-supplied data when parsing the DjVu file format. It is triggered when ExifTool processes a crafted image or DjVu file, causing attacker-controlled input to be evaluated and executed in the context of the process doing the parsing. An attacker who can get a malicious file parsed, for example through a web service, media pipeline, or desktop application that extracts metadata from uploaded files, gains arbitrary code execution on the host. Any deployment running an affected ExifTool version that handles untrusted files is exposed, and because ExifTool is embedded inside many third-party products, affected systems may not have ExifTool visible in their inventory by name. The flaw is being actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-17, EPSS assigns it a 100% probability of exploitation within 30 days (top percentile), and CISA's required action is to apply updates per vendor instructions.

What to do: Upgrade ExifTool to version 12.38 or later wherever it is installed directly or bundled inside other software, and apply vendor-supplied patches for any third-party products that embed ExifTool. Prioritize systems that parse untrusted or user-uploaded images; as an interim mitigation, block or strip DjVu-formatted uploads and disable DjVu metadata extraction until patching is complete. Because the flaw is in CISA's KEV catalog with an active exploitation window, treat remediation as urgent and verify asset inventory for embedded copies of ExifTool.