CVE-2022-23521: Git gitattributes parsing integer overflow enables heap corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication or user interaction, and potential remote code execution, combined with a very high EPSS score, makes this a critical patching priority.

What it is

Git's gitattributes parser suffers multiple integer overflows when handling a huge number of path patterns, many attributes for one pattern, or very long attribute names. A crafted .gitattributes file, including one already in commit history, can trigger the overflow, and because Git splits long lines only when reading from a file and not from the index, the failure mode varies by where the file exists. The flaw can cause arbitrary heap reads and writes, potentially leading to remote code execution.

Impact

An attacker can corrupt heap memory, leading to arbitrary reads and writes and potentially remote code execution in the context of the Git process. This can compromise the repository, the developer's machine, or any system processing the malicious repository.

Attack surface

The vulnerability is network-reachable with no privileges or user interaction required per the CVSS vector, and is triggered by processing a repository containing a crafted .gitattributes file. It can be reached through normal Git operations such as cloning, fetching, or checking out a malicious repository.

Exploitation

The CVE is not listed in CISA KEV and no ransomware use is documented; EPSS gives a 30-day exploitation probability of 0.563 (99th percentile), and the references include a patch and vendor advisory but no public exploit tag.

What to do

• Upgrade Git to a version published on or after 2023-01-17, at minimum v2.30.7 or newer, as the issue is patched there.
• Apply the vendor patch commit 508386c6c5857b4faa2c3e491f422c98cc69ae76 if building from source.
• Treat untrusted repositories as hostile: avoid cloning or checking out repositories from untrusted sources until patched.
• Monitor Git security advisories and distribution packages (for example Gentoo GLSA 202312-15) for updated builds.
• There are no known workarounds, so patching is the only effective remediation.

Detection

• Scan repositories for unusually large or malformed .gitattributes files, especially those with very long lines or an excessive number of patterns or attributes.
• Monitor Git process crashes or memory errors during clone, fetch, or checkout operations, which may indicate exploitation attempts.
• Audit commit history for .gitattributes files that were added or modified in unexpected ways, since the file may be part of the commit history.
• Use endpoint detection to flag abnormal memory access patterns or code execution originating from Git processes handling untrusted repositories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.