SB20250709120 - Microsoft Visual Studio update for Git
Published: July 9, 2025
Security Bulletin ID
SB20250709120
Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Untrusted search path (CVE-ID: CVE-2025-46334)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to usage of an untrusted search path in Git GUI on Windows. A malicious repository can ship versions of sh.exe or typical textconv filter programs such as astextplain. On Windows, path lookup can find such executables in the worktree. These programs are invoked when the user selects "Git Bash" or "Browse Files" from the menu.
Note, the vulnerability affects Windows installations only.
Remediation
Install update from vendor's website.