CVE-2016-2324

42

FAUCET Score

CVE-2016-2324 is a critical integer overflow vulnerability in Git versions prior to 2.7.4, affecting products like git-scm, openSUSE, and SUSE. This flaw allows remote attackers to execute arbitrary code through specially crafted long filenames or numerous nested trees, leading to a heap-based buffer overflow. With a CVSS score of 9.8 (Critical), it presents a severe risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While not listed in CISA's KEV catalog and lacking public Metasploit or ExploitDB modules, the vulnerability has garnered significant community discussion and media coverage, indicating a high level of awareness and potential for future exploitation.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		11CPE matchmatch criteria	cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4::::::
		5CPE matchmatch criteria	cpe:2.3:a:suse:openstack_cloud:5:::::::*
		42.1CPE matchmatch criteria	cpe:2.3:o:opensuse:leap:42.1:::::::*
		13.2CPE matchmatch criteria	cpe:2.3:o:opensuse:opensuse:13.2:::::::*
		12.0CPE matchmatch criteria	cpe:2.3:o:suse:linux_enterprise_server:12.0:sp1::::::

CVSS Data

CVSS version used by this source: 3.1

9.8CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

5.9

CvssVersion

3.1

Exploit Intelligence

EPSS Score

18.81%

Probability of exploitation in next 30 days

EPSS Percentile

97.0%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.1881 is in the 93rd percentile among its peer group of 36,862 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (10)

github_advisorypatch availablevia nvd_reference

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6Fixed in: git-0:1.7.1-4.el6_7.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: git-0:1.8.3.1-6.el7_2.1

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: git19-git-0:1.9.4-4.el6.1

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUSFixed in: git19-git-0:1.9.4-4.el6.1

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUSFixed in: git19-git-0:1.9.4-4.el6.1

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: git19-git-0:1.9.4-4.el7.1

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUSFixed in: git19-git-0:1.9.4-4.el7.1

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUSFixed in: git19-git-0:1.9.4-4.el7.1

susevendor investigatingvia nvd_reference

Vendor Advisories (1)

redhatCVE-2016-2324Important

git: path_name() integer truncation and overflow leading to buffer overflow

References

lists.fedoraproject.org / pipermail/package-announce/2016-April/183147.html

Mailing ListThird Party Advisory

lists.fedoraproject.org / pipermail/package-announce/2016-March/179121.html

Mailing ListThird Party Advisory

lists.fedoraproject.org / pipermail/package-announce/2016-March/180763.html

Mailing ListThird Party Advisory

lists.opensuse.org / opensuse-security-announce/2016-03/msg00059.html

Mailing ListVendor Advisory

lists.opensuse.org / opensuse-security-announce/2016-03/msg00060.html

Mailing ListVendor Advisory

lists.opensuse.org / opensuse-security-announce/2016-03/msg00061.html

Mailing ListVendor Advisory

lists.opensuse.org / opensuse-security-announce/2016-03/msg00062.html

Mailing ListVendor Advisory

lists.opensuse.org / opensuse-security-announce/2016-03/msg00071.html

Mailing ListVendor Advisory

lists.opensuse.org / opensuse-security-announce/2016-03/msg00074.html

Mailing ListVendor Advisory

lists.opensuse.org / opensuse-security-announce/2016-03/msg00076.html

Mailing ListVendor Advisory

lists.opensuse.org / opensuse-security-announce/2016-03/msg00077.html

Mailing ListVendor Advisory

lists.opensuse.org / opensuse-updates/2016-04/msg00011.html

Mailing ListVendor Advisory

pastebin.com / UX2P2jjg

Third Party Advisory

rhn.redhat.com / errata/RHSA-2016-0496.html

Third Party Advisory

github.com / git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60

PatchThird Party Advisory

raw.githubusercontent.com / git/git/master/Documentation/RelNotes/2.7.4.txt

Vendor Advisory

security.gentoo.org / glsa/201605-01

Third Party Advisory

debian.org / security/2016/dsa-3521

Third Party Advisory

openwall.com / lists/oss-security/2016/03/15/5

Mailing ListThird Party Advisory

oracle.com / technetwork/topics/security/bulletinapr2016-2952098.html

Third Party Advisory

oracle.com / technetwork/topics/security/linuxbulletinapr2016-2952096.html

Third Party Advisory

securityfocus.com / bid/84355

Third Party AdvisoryVDB Entry

securitytracker.com / id/1035290

Third Party AdvisoryVDB Entry

ubuntu.com / usn/USN-2938-1

Third Party Advisory