git-for-windows Git up to 2.55.0.windows.2 git-credential-wincred git-credential-wincred.c match_cred_password heap-based overflow

Summaryinfo

A vulnerability was found in git-for-windows Git up to 2.55.0.windows.2 and classified as problematic. Impacted is the function match_cred_password of the file contrib/credential/wincred/git-credential-wincred.c of the component git-credential-wincred. The manipulation results in heap-based overflow. This vulnerability is identified as CVE-2026-100408. The attack is only possible with local access. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in git-for-windows Git up to 2.55.0.windows.2. It has been classified as problematic. Affected is the function match_cred_password of the file contrib/credential/wincred/git-credential-wincred.c of the component git-credential-wincred. The manipulation with an unknown input leads to a heap-based overflow vulnerability. CWE is classifying the issue as CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). This is going to have an impact on integrity, and availability. CVE summarizes:

Git for Windows is the Windows port of Git. From 2.43.0.windows.1 until 2.55.0.windows.3, when a matching git:* credential exists in Windows Credential Manager and a git-credential-wincred erase input includes a password field, the operation in contrib/credential/wincred/git-credential-wincred.c allocates a buffer of exactly CredentialBlobSize bytes in match_cred_password() and then uses wcsncpy_s() to copy the corresponding number of wide characters plus a terminating NUL. The destination capacity is also supplied in bytes instead of WCHAR elements, allowing a fixed two-byte NUL write past the allocation before the password comparison determines whether CredDeleteW() should remove the credential; erase without a password field does not enter this comparison path. The helper can terminate with Windows heap-corruption status, and git credential reject can appear successful while the rejected credential remains stored. This issue is fixed in version 2.55.0.windows.3.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-100408 since 09/25/2026. The exploitability is told to be easy. Local access is required to approach this attack. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit.

Upgrading to version 2.55.0.windows.3 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Versioning Software

Vendor

• git-for-windows

Name

• Git

Version

• 2.55.0.windows.0
• 2.55.0.windows.1
• 2.55.0.windows.2

License

• open-source

Website

• Product: https://github.com/git-for-windows/git/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion