CVE-2021-27815

NULL Pointer Deference in the exif command line tool, when printing out XML formatted EXIF data, in exif v0.6.22 and earlier allows attackers to cause a Denial of Service (DoS) by uploading a malicious JPEG file, causing the application to crash.

• CWE-476

• https://github.com/libexif/exif/commit/eb84b0e3c5f2a86013b6fcfb800d187896a648faPatch, Third Party Advisory
• https://github.com/libexif/exif/commit/f6334d9d32437ef13dc902f0a88a2be0063d9d1cPatch, Third Party Advisory
• https://github.com/libexif/exif/issues/4Exploit, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSWAXZVNXYLV3E4R6YQTEGRGMGWEAR76/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMC6OTXZRPCUD3LOSWO4ISR7CH7NJQDT/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZQ3L45F7S7PQPG5HEHXOCGNOO64MJOS/
• https://security.gentoo.org/glsa/202210-28Third Party Advisory
• https://github.com/libexif/exif/commit/eb84b0e3c5f2a86013b6fcfb800d187896a648faPatch, Third Party Advisory
• https://github.com/libexif/exif/commit/f6334d9d32437ef13dc902f0a88a2be0063d9d1cPatch, Third Party Advisory
• https://github.com/libexif/exif/issues/4Exploit, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSWAXZVNXYLV3E4R6YQTEGRGMGWEAR76/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMC6OTXZRPCUD3LOSWO4ISR7CH7NJQDT/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZQ3L45F7S7PQPG5HEHXOCGNOO64MJOS/
• https://security.gentoo.org/glsa/202210-28Third Party Advisory

Published

Apr 14, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-27799ean_leading_zeroes in backend/upcean.c in Zint Barcode Gener…7.5
• CVE-2021-27802Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-27803A vulnerability was discovered in how p2p/p2p_pd.c in wpa_su…7.5
• CVE-2021-27804JPEG XL (aka jpeg-xl) through 0.3.2 allows writable memory c…9.8
• CVE-2021-27807A carefully crafted PDF file can trigger an infinite loop wh…5.5
• CVE-2021-27811A code injection vulnerability has been discovered in the Up…7.2
• CVE-2021-27817A remote command execution vulnerability in shopxo 1.9.3 all…9.8
• CVE-2021-27821The Web Interface for OpenWRT LuCI version 19.07 and lower h…6.1
• CVE-2021-27822A persistent cross site scripting (XSS) vulnerability in the…4.8
• CVE-2021-27823An information disclosure vulnerability was discovered in /i…7.5
• CVE-2021-27825A directory traversal vulnerability on Mercury MAC1200R devi…7.5
• CVE-2021-27828SQL injection in In4Suite ERP 3.2.74.1370 allows attackers t…9.1