NTLM Hash Exposure in Git for Windows
CVE-2025-66413

7.4HIGH

Key Information:

Vendor

Git-for-windows

Status
Git
Vendor
CVE Published:
10 March 2026

What is CVE-2025-66413?

The vulnerability in Git for Windows allows attackers to obtain a user's NTLM hash by deceiving them into cloning from a malicious server. Exploiting this vulnerability could lead to unauthorized access as the NTLM hash is susceptible to brute-force attacks, potentially revealing the user's account name and password. This issue affects all versions prior to 2.53.0(2) and highlights the importance of securing interactions with external servers.

Affected Version(s)

git < 2.53.0(2)

References

https://github.com/git-for-windows/git/security/advisorie...
x_refsource_CONFIRM
https://github.com/git-for-windows/git/releases/tag/v2.53...
x_refsource_MISC

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.