Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2022-41903

Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., `git log --format=...`). It may also be triggered indirectly through git archive via the export-subst mechanism, which expands format specifiers inside of files within the repository during a git archive. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. Users who are unable to upgrade should disable `git archive` in untrusted repositories. If you expose git archive via `git daemon`, disable it by running `git config --global daemon.uploadArch false`.

CVSS 9.8 · CriticalBuzz score 36.5

Buzz score

Why this CVE is surfacing

Buzz score total 36.5

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 22.0 · diversity 14.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Mention score
22.0
8 evidence mentions in the snapshot
Diversity score
14.5
5 sources across 2 categories
KEV score
0.0
No KEV entry observed
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
8 source links · newest first
  • GitLab fixes critical vulnerability, patch now! (CVE-2023-5009)Help Net Security

    GitLab has fixed a critical vulnerability (CVE-2023-5009) in the Enterprise Edition (EE) and Community Edition (CE) of its widely used DevOps platform. The flaw may allow a threat actor to abuse scan execution policies to run pipelines as another user. About the vulnerability (CVE-2023-5009) CVE-2023-5009 – discovered by software developer and bug hunter Johan Carlsson (joaxcar) in GitLab EE – affects all versions starting from 13.12 before 16.2.7 and all versions starting from 16.3 before … More →

    newswww.helpnetsecurity.comSep 22, 2023, 10:29 AM
  • Atlassian addressed 3 flaws in Confluence and Bamboo productsSecurity Affairs

    Atlassian addressed three vulnerabilities in its Confluence Server, Data Center, and Bamboo Data Center products that can lead to remote code execution. Atlassian has addressed three critical and high severity vulnerabilities impacting the Confluence Server, Data Center, and Bamboo Data Center products. Successful exploitation of the vulnerabilities could result in remote code execution on vulnerable systems. According to […]

    newssecurityaffairs.comJul 25, 2023, 9:36 PM
  • 23rd January – Threat Intelligence ReportCheck Point Research

    For the latest discoveries in cyber research for the week of 23rd January, please download our Threat_Intelligence Bulletin TOP ATTACKS AND BREACHES The fast food brand ‘Yum! Brands’, operator of leading fast food restaurants including KFC, Pizza Hut and Taco Bell, has been targeted by a ransomware attack. The attack lead to the temporary closure […]

    vendorresearch.checkpoint.comJan 23, 2023, 1:50 PM
  • Week in review: Critical git vulnerabilities, increasingly malicious Google Search adsHelp Net Security

    Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Cacti servers under attack by attackers exploiting CVE-2022-46169 If you’re running the Cacti network monitoring solution and you haven’t updated it since early December, now is the time to do it to foil attackers exploiting a critical command injection flaw (CVE-2022-46169). CircleCI breach post-mortem: Attackers got in by stealing engineer’s session cookie The attackers who pulled off the recent breach … More →

    newswww.helpnetsecurity.comJan 22, 2023, 9:30 AM
  • Critical RCE vulnerabilities found in git (CVE-2022-41903, CVE-2022-23251)Help Net Security

    A source code audit has revealed two critical vulnerabilities affecting git, the popular distributed version control system for collaborative software development. The latest git vulnerabilities CVE-2022-41903 is an out-of-bounds memory write flaw in log formatting and CVE-2022-23251 is a truncated allocation leading to out-of-bounds write via large number of attributes. Both may result in remote code execution. More technical info about each of the flaws can be found in this post by X41 D-Sec researchers … More →

    newswww.helpnetsecurity.comJan 19, 2023, 12:04 PM
  • Two critical flaws discovered in Git source code version control systemSecurity Affairs

    The maintainers of the Git source code version control system urge to update the software to fix two critical vulnerabilities. The maintainers of the Git source code version control system announced to have fixed a couple of critical vulnerabilities, tracked as CVE-2022-23521 and CVE-2022-41903, in their software. The flaws were discovered as part of a security source code audit of the source […]

    newssecurityaffairs.comJan 18, 2023, 8:03 PM
  • Update now! Two critical flaws in Git’s code found, patchedMalwarebytes Labs

    In a sponsored security source code audit, security experts from X41 D-SEC GmbH (Eric Sesterhenn and Markus Vervier) and GitLab (Joern…

    newswww.malwarebytes.comJan 18, 2023, 5:00 PM
  • Critical Git Vulnerabilities Discovered in Source Code Security AuditSecurityWeek

    A source code security audit led to the discovery of several vulnerabilities in Git, the widely used distributed version control system.

    newswww.securityweek.comJan 18, 2023, 2:58 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence
  • CVE-2022-23521

    Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file…

    CVSS 9.8 · Critical
    5 mentions
  • CVE-2026-16529

    A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affe…

    CVSS 7.5 · High
    2 mentions
  • CVE-2026-17726

    Integer overflow in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium s…

    CVSS N/A · Unrated
    2 mentions
  • CVE-2026-17717

    Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security sev…

    CVSS 9.6 · Critical
    2 mentions
  • CVE-2026-17705

    Integer overflow in libxml in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security…

    CVSS 8.8 · High
    2 mentions
  • CVE-2026-17682

    Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a…

    CVSS 9.6 · Critical
    2 mentions