CVE-2021-37621 - CVE House
Back to Database
Status published Medium CVE-2021-37621

Denial of service due to infinite loop in Image::printIFDStructure

Vulnerability Description

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. An infinite loop was found in Exiv2 versions v0.27.4 and earlier. The infinite loop is triggered when Exiv2 is used to print the metadata of a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service, if they can trick the victim into running Exiv2 on a crafted image file. Note that this bug is only triggered when printing the image ICC profile, which is a less frequently used Exiv2 operation that requires an extra command line option (`-p C`). The bug is fixed in version v0.27.5.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-37621

Credits & Attribution

No credits recorded in the NVD database.

References

More from Exiv2

View All →
CVE-2025-55304
Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata
Low 1.8
CVE-2025-54080
Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file
Low 1.8
CVE-2025-26623
Use After Free in Exiv2
Medium 5.3
CVE-2024-39695
Exiv2 has an out-of-bounds read in AsfVideo::streamProperties
Medium 5.3
CVE-2024-25112
Denial of service due to unbounded recursion in QuickTimeVideo::multipleEntriesDecoder in Exiv2
Medium 5.5

Affected Vendor

Affected Software

exiv2
Vulnerable Versions:
<= 0.27.4

Timeline

Official Publish: August 9th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-835

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1562 Impair Defenses
Defense Evasion
T1485 Data Destruction
Impact