ExifTool Remote Code Execution Vulnerability

A local attacker, without authentication, can achieve partial data exposure, partial data tampering, partial service disruption. Federal agencies are required to remediate by 2021-12-01 under CISA BOD 22-01.

This is a Code Injection (CWE-94) vulnerability in Perl Exiftool. Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image Exploitation requires local access, low attack complexity, no authentication required, and no user interaction required.

Probably yes if any of these apply:

Active exploitation documented in the wild. Threat-research write-up: http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html