CVE-2022-37172: MSYS2

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

Incorrect access control in the install directory (C:\msys64) of Msys2 v20220603 and below allows authenticated attackers to execute arbitrary code via overwriting binaries located in the directory.

Affected products

• MSYS2 MSYS2: up to and including 20220603

Published 2022-08-30. Last modified 2026-06-17.