Heap overflow in Git for Windows credential helper erase path
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- Partial Red Hat: 9 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
Git for Windows from 2.43.0.windows.1 before 2.55.0.windows.3 contains an out-of-bounds write (CWE-787) in the git-credential-wincred helper. When erasing a stored password, the helper allocates too little memory, so a wide-character copy writes past the end of the heap buffer. A local attacker with no privileges can trigger it with user interaction, which can terminate the helper and leave a rejected credential stored.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Git for Windows is the Windows port of Git. From 2.43.0.windows.1 until 2.55.0.windows.3, when a matching git:* credential exists in Windows Credential Manager and a git-credential-wincred erase input includes a password field, the operation in contrib/credential/wincred/git-credential-wincred.c allocates a buffer of exactly CredentialBlobSize bytes in match_cred_password() and then uses wcsncpy_s() to copy the corresponding number of wide characters plus a terminating NUL. The destination capacity is also supplied in bytes instead of WCHAR elements, allowing a fixed two-byte NUL write past the allocation before the password comparison determines whether CredDeleteW() should remove the credential; erase without a password field does not enter this comparison path. The helper can terminate with Windows heap-corruption status, and git credential reject can appear successful while the rejected credential remains stored. This issue is fixed in version 2.55.0.windows.3.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| git-for-windows | git | 2.43.0.windows.1 to before 2.55.0.windows.3 | 2.55.0.windows.3 | Patch available | CNA |
- git Vendorgit-for-windows Affected 2.43.0.windows.1 to before 2.55.0.windows.3 Fixed in 2.55.0.windows.3 Patch available CNA
Remediation
Upgrade Git for Windows to 2.55.0.windows.3, which fixes the issue. Red Hat lists Red Hat Enterprise Linux 6, 7, 8, 9 and 10, Red Hat Hardened Images, Red Hat OpenShift Container Platform 4 and 5, and Red Hat Satellite 6 as affected without a fix.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA git (git-for-windows) Fixed in 2.55.0.windows.3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | — |
| Red Hat Enterprise Linux 6 | Affected | — |
| Red Hat Enterprise Linux 7 | Affected | — |
| Red Hat Enterprise Linux 8 | Affected | — |
| Red Hat Enterprise Linux 9 | Affected | — |
| Red Hat Hardened Images | Affected | — |
| Red Hat OpenShift Container Platform 4 | Affected | — |
| Red Hat OpenShift Container Platform 5 | Affected | — |
| Red Hat Satellite 6 | Affected | — |
Timeline
- 2026-11-04 Threatist record created from CVE-2026-100408
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
More git-for-windows vulnerabilities
- TI-2026-44986 Git for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on Windows CVSS 3.1HIGH 7.4
- TI-2025-40849 Git for Windows leaks NTLM hash when cloning from an attacker-controlled server CVSS 3.1HIGH 7.4
- TI-2018-07996 In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4… CVSS 3.0HIGH 7.8
- TI-2026-85080 Out-of-bounds write in Git for Windows credential helper CVSS 3.1MEDIUM 4.4
- TI-2022-20294 Git clone remote code execution vulnerability in git-for-windows CVSS 3.1HIGH 8.6
- TI-2023-09447 gitk can inadvertently call executables in the worktree CVSS 3.1HIGH 8.6
Sources
- CVE-2026-100408 · CVE Program
- CVE-2026-100408 · NVD
- FIRST EPSS
- CVE-2026-100408 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences