Red Hat Product Security has published an advisory (RHSA-2025:11795) for two Git vulnerabilities: CVE-2025-48384 (arbitrary code execution) and CVE-2025-48385 (arbitrary file writes). Git, a distributed version control system, is affected in Red Hat Enterprise Linux 9.2 and related packages. The advisory provides updated Git packages that fix these vulnerabilities. The vulnerabilities are rated as having important security impact by Red Hat, with a high severity classification in the source data. No CVSS scores are provided in the advisory or CVE data. The advisory includes detailed package updates for multiple architectures and product variants. No exploits in the wild are currently known.

Successful exploitation of CVE-2025-48384 could allow arbitrary code execution within the context of the user running Git, potentially leading to compromise of the system or user environment. CVE-2025-48385 could allow arbitrary file writes, which may be leveraged to modify or create files without authorization. Both vulnerabilities affect Git operations on affected Red Hat Enterprise Linux 9.2 systems. No evidence of active exploitation has been reported. The impact is considered high due to the nature of arbitrary code execution and file write capabilities.

Red Hat has released updated Git packages for Red Hat Enterprise Linux 9.2 that address these vulnerabilities. Users and administrators should apply the security update as soon as possible by following the instructions in the Red Hat advisory RHSA-2025:11795 and the referenced article https://access.redhat.com/articles/11258. Applying the official update fully mitigates the vulnerabilities. There is no indication from the vendor advisory that additional mitigation steps are required beyond applying the update.