CVE-2021-22204

ExifTool can be tricked into running harmful code when reading a specially crafted DjVu image file. An attacker can exploit this by sending a malicious image that executes arbitrary commands on the affected system.

ExifTool versions 7.44+ fail to properly neutralize untrusted input when parsing DjVu file metadata, allowing injection of arbitrary code through crafted image files. The attack vector is local/remote file parsing with no user interaction required; successful exploitation leads to arbitrary code execution in the context of the ExifTool process.