cyfenced.com →

[ CVE-2021-22204 · Published 23 Apr 2021 ]

ExifTool Remote Code Execution Vulnerability

Exploited · CISA KEV CVSS 7.8 EPSS 100%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-11-17
  • EPSS: 100% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

CISA: Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 1 Dec 2021): Apply updates per vendor instructions.

[ References ]References