CVE Database · CVE-2021-22204
CVSS v3.1
6.8
EPSS
99.98%
Published
Apr 23, 2021
Modified
Nov 3, 2025
CISA Known Exploited Vulnerability
Added: 2021-11-17 · Due: 2021-12-01
Apply updates per vendor instructions.
Public PoC / Exploit (10)
All weaponized →Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.
Description
Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:LWeaknesses (CWE)
Affected Products (6)
References (20)