GitHub: CVE-2025-46835 Git File Overwrite Vulnerability
🔗 CVE IDs covered (1)
📋 Description
CVE-2025-46835 is regarding a vulnerability in Git GUI where when a user clones an untrusted repository and is tricked into editing a file located in a maliciously named directory in the repository, then Git GUI can create and overwrite any writable file. GitHub created this CVE on their behalf. The documented Visual Studio updates incorporate updates in GitK which address this vulnerability. Please see CVE-2025-46835 for more information.
🎯 Affected products6
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
- Microsoft Visual Studio 2022 version 17.10
- Microsoft Visual Studio 2022 version 17.12
- Microsoft Visual Studio 2022 version 17.14
- Microsoft Visual Studio 2022 version 17.8
✅ Remediation
KBRelease Notes (Security Update) — fixed build 17.8.23 KBRelease Notes (Security Update) — fixed build 17.10.17 KBRelease Notes (Security Update) — fixed build 17.12.10 KBRelease Notes (Security Update) — fixed build 17.14.8 KBRelease Notes (Security Update) — fixed build 16.11.49 KBRelease Notes (Security Update) — fixed build 15.9.75
🔗 References (10)
- advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-46835
- patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.8
- referencehttps://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
- patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.10
- patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.12
- patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.14
- patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2019 version 16.11
- referencehttps://docs.microsoft.com/en-us/visualstudio/releases/2019/release-notes-v16.11
- patchhttp://aka.ms/vs/15/release/latest
- referencehttps://docs.microsoft.com/en-us/visualstudio/releasenotes/vs2017-relnotes