CVE-2022-41716medium

CVE-2022-41716: medium-severity vulnerability in Go standard library syscall

Unsanitized NUL in environment variables on Windows in syscall and os/exec

Published · Updated

Follow this CVE+ Monitor os/exec+ Monitor syscall

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3epss 1.0%
Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D".
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected products
Go standard library · os/execGo standard library · syscall
Related CVEs — Go standard library syscall

In the same product, most dangerous first.

CVE-2022-30580HIGHEmpty Cmd.Path can trigger unintended binary in os/exec on WindowsEPSS 0.7%CVE-2025-47906MEDIUMUnexpected paths returned from LookPath in os/execEPSS 0.5%CVE-2025-0913MEDIUMInconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscallEPSS 0.3%