Critical Remote Code Execution in ExifTool (CVE‑2021‑22204) Threatens DjVu Image Parsing
What It Is – ExifTool 7.44 and later mishandle user‑controlled data in the DjVu file format, allowing an attacker to execute arbitrary code on the host that processes the image.
Exploitability – A public proof‑of‑concept exists; the vulnerability scores CVSS 3.1 9.8 (Critical) and can be triggered remotely by sending a crafted DjVu file to any service that invokes ExifTool.
Affected Products – Perl ExifTool library (versions 7.44 through 7.78). Any application, script, or service that calls ExifTool for metadata extraction is potentially vulnerable.
Why It Matters for Trust & Control Assurance
- Highlights gaps in software‑supply‑chain control mapping – a single third‑party component can undermine the entire trust posture.
- Demonstrates the need for continuous monitoring evidence that vulnerable libraries have been patched, a key audit artifact.
- Provides a concrete example of why defensible evidence of due‑diligence (patch management, component inventory) is now a procurement requirement for many enterprise buyers.
Recommended Actions
- Upgrade ExifTool to version 7.45 or later, which contains the fix for CVE‑2021‑22204.
- Conduct an inventory of all systems and pipelines that invoke ExifTool; verify they are patched.
- Record the remediation in your control‑mapping repository and capture the patch evidence for audit readiness.
Source: CISA KEV – CVE‑2021‑22204