CVE-2008-3546

Stack-based buffer overflow in the (1) diff_addremove and (2) diff_change functions in GIT before...

7.5 HighFix available

CVE-2008-3546 is a high vulnerability (CVSS 7.5) in Git, published August 7, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.30%, the 91st percentile. Fixed in git-core 1:1.4.4.4-2.1+etch1.

Stack-based buffer overflow in the (1) diff_addremove and (2) diff_change functions in GIT before 1.5.6.4 might allow local users to execute arbitrary code via a PATH whose length is larger than the system's PATH_MAX when running GIT utilities such as git-diff or git-grep.

Exploit likelihood

4.30%Up 2.1 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2008-3546
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Record: CVE-2008-3546
Updated: 2026-11-02

EUVDEUVD-2008-3532 No score

Record: EUVD-2008-3532
Updated: 2026-11-03

GitHub AdvisoriesGHSA-j9cr-wr26-g3fp No score

Stack-based buffer overflow in the (1) diff_addremove and (2) diff_change functions in GIT before...

Record: GHSA-j9cr-wr26-g3fp
Weakness: CWE-119
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`git-core` Debian:4.0	before 1:1.4.4.4-2.1+etch1, plus listed versions 1:1.4.4.4-2	1:1.4.4.4-2.1+etch1
`git-core` Debian:5.0	before 1.5.6.3-1+lenny1	1.5.6.3-1+lenny1
`git-core` Debian:5.0	before 1.5.6.3-1+lenny2	1.5.6.3-1+lenny2

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 14 moreShow less