CVE-2022-41716: Unsanitized NUL in environment variables on Windows in syscall and os/exec
Vulnerability summary
CVE-2022-41716 is a high (CVSS 7.5) vulnerability in go standard library os/exec. EPSS estimates a 1.03% chance of exploitation in the next 30 days, higher than 63.6% of scored vulnerabilities.
Not severe (CVSS 6.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1 · Related 3Timeline
- 02-11-2022PublishedVulnerability first disclosed.
- 30-10-2024Last modifiedVulnerability information updated.
Description
Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D".
CVSS metrics
6 scores · 6 sources · 1 version- CVE.orgCNA6.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · WolfiEcosystem advisory · calculated6.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
- OSV · ChainguardEcosystem advisory · calculated6.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
EPSS trend
Probability
1.03%
Chance of exploitation in the next 30 days
Percentile
64%
Versus all other CVEs
30-day change
Increase +0.19 pp
From 0.84% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard10 products
- katib-earlystopping< 0.19.0-r31
- katib-suggestion-goptuna-compatAll versions (No fix recorded)
- katib-suggestion-hyperband< 0.19.0-r31
- katib-suggestion-hyperopt< 0.19.0-r31 | < 0.19.0-r40
- katib-suggestion-nas-darts< 0.19.0-r31
Ubuntu10 products
- golang-1.10All versions (No fix recorded)
- golang-1.13All versions (No fix recorded)
- golang-1.14All versions (No fix recorded)
- golang-1.16All versions (No fix recorded)
- golang-1.17All versions (No fix recorded)
Wolfi10 products
- katib-earlystopping< 0.19.0-r31
- katib-suggestion-goptuna-compatAll versions (No fix recorded)
- katib-suggestion-hyperband< 0.19.0-r31
- katib-suggestion-hyperopt< 0.19.0-r31 | < 0.19.0-r40
- katib-suggestion-nas-darts< 0.19.0-r31
Opensuse6 products
- go1.18&distro=openSUSE Leap 15.3< 1.18.8-150000.1.37.1
- go1.18&distro=openSUSE Leap 15.4< 1.18.8-150000.1.37.1
- go1.18&distro=openSUSE Tumbleweed< 1.18.8-1.1
- go1.19&distro=openSUSE Leap 15.3< 1.19.3-150000.1.15.1
- go1.19&distro=openSUSE Leap 15.4< 1.19.3-150000.1.15.1
Suse4 products
- go1.18&distro=SUSE Linux Enterprise Module for Development Tools 15 SP3< 1.18.8-150000.1.37.1
- go1.18&distro=SUSE Linux Enterprise Module for Development Tools 15 SP4< 1.18.8-150000.1.37.1
- go1.19&distro=SUSE Linux Enterprise Module for Development Tools 15 SP3< 1.19.3-150000.1.15.1
- go1.19&distro=SUSE Linux Enterprise Module for Development Tools 15 SP4< 1.19.3-150000.1.15.1
Go standard library2 products
Debian1 product
- golang-1.19< 1.19.3-1
Go1 product
- stdlib≥ 1.19.0-0, < 1.19.3
Golang1 product
- go< 1.18.8 | ≥ 1.19.0, < 1.19.3
Mageia1 product
- golang< 1.18.8-1.mga8
10 vendors · 46 products
References
23 links- groups.google.com/g/golang-announce/c/mbHY1UY3BaM/m/hSpmRzk-AgAJREPORTWEBPatchRelease NotesVendor Advisory
Show all 23 references
- pkg.go.devWEB
