Buffer Overflow and Heap Corruption in Git for Windows Affecting Multiple Versions
CVE-2026-100407

4.4MEDIUM

Key Information:

Vendor

Git-for-windows

Status
Git
Vendor
CVE Published:
4 November 2026

What is CVE-2026-100407?

A vulnerability in Git for Windows versions 2.44.0.windows.1 through 2.55.0.windows.3 affects the git-credential-wincred store operation. This vulnerability occurs due to improper allocation of a formatted wide-character credential buffer where a terminating NUL is not accounted for when both password and oauth_refresh_token are provided. Consequently, passing a byte count instead of a wide-character count to the _snwprintf_s() function can lead to a fixed two-byte NUL overwrite, which may terminate the helper with a Windows heap-corruption status. As a result, this flaw can cause the git credential approve action to report success, although the OAuth credential may not actually be stored. The issue has been remedied in version 2.55.0.windows.3.

Affected Version(s)

git >= 2.44.0.windows.1, < 2.55.0.windows.3

References

https://github.com/git-for-windows/git/security/advisorie...
x_refsource_CONFIRM
https://github.com/git-for-windows/git/commit/52ca1113d65...
x_refsource_MISC
https://github.com/git-for-windows/git/releases/tag/v2.55...
x_refsource_MISC

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.