{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2022-41903",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2022-41903",
    "idYear": 2022,
    "status": "PUBLISHED",
    "publishedAt": "2023-01-17T22:17:16.123Z",
    "updatedAt": "2025-03-10T21:21:50.039Z",
    "importedAt": "2026-10-24T01:56:45.230Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "Integer overflow in `git archive`, `git log --format` leading to RCE in git",
      "summary": "Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., `git log --format=...`). It may also be triggered indirectly through git archive via the export-subst mechanism, which expands format specifiers inside of files within the repository during a git archive. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. Users who are unable to upgrade should disable `git archive` in untrusted repositories. If you expose git archive via `git daemon`, disable it by running `git config --global daemon.uploadArch false`.",
      "affected": [
        {
          "vendor": "git",
          "product": "git",
          "versions": [
            {
              "version": "< 2.30.7",
              "status": "affected"
            },
            {
              "version": ">= 2.31.0, < 2.31.6",
              "status": "affected"
            },
            {
              "version": ">= 2.32.0, < 2.32.5",
              "status": "affected"
            },
            {
              "version": ">= 2.33.0, < 2.33.6",
              "status": "affected"
            },
            {
              "version": ">= 2.34.0, < 2.34.6",
              "status": "affected"
            },
            {
              "version": ">= 2.35.0, < 2.35.6",
              "status": "affected"
            },
            {
              "version": ">= 2.36.0, < 2.36.4",
              "status": "affected"
            },
            {
              "version": ">= 2.37.0, < 2.37.5",
              "status": "affected"
            },
            {
              "version": ">= 2.38.0, < 2.38.3",
              "status": "affected"
            },
            {
              "version": "= 2.39.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  }
}