What’s Vulnerable › Vulnerabilities

CVE-2022-24767

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-04-12 · updated 2026-06-17
• Weakness: CWE-427

Description

GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account.

Affected products

• git-for-windows git: before 2.35.2 — fixed in 2.35.2
• Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8): from 15.0 before 15.9.46 — fixed in 15.9.46
• Microsoft Visual Studio 2019: from 16.0 before 16.7.27; from 16.8 before 16.9.19; from 16.10 before 16.11.12 — fixed in 16.11.12, 16.7.27, 16.9.19
• Microsoft Visual Studio 2022 version 17.14: from 17.0 before 17.0.8; from 17.1.0 before 17.1.4 — fixed in 17.0.8, 17.1.4
• Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10): all versions
• Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6): all versions
• Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8): all versions
• Microsoft Visual Studio 2022 version 17.0: all versions
• Microsoft Visual Studio 2022 version 17.1: all versions
• Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8): all versions

How to fix

Upgrade to a fixed version: git-for-windows git 2.35.2; Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) 15.9.46; Microsoft Visual Studio 2019 16.11.12, 16.7.27, 16.9.19; Microsoft Visual Studio 2022 version 17.14 17.0.8, 17.1.4. Check the vendor advisory for mitigations.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-24767
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-24767

Get alerted when CVE-2022-24767 or the next vulnerability affects your stack