Windows Port of Git Credential Manager Buffer Overflow Vulnerability

CVE-2026-100408

What is CVE-2026-100408?

In the Windows port of Git, a vulnerability exists in the credential management process related to improper buffer handling when erasing credentials that include a password. Specifically, the operation allocates memory based on a fixed size, and when wide characters are copied to the allocated buffer with wcsncpy_s(), it does not account correctly for the NUL terminator, leading to heap corruption. Consequently, this can allow for potential retention of deleted credentials, posing a security risk. This issue has been addressed in version 2.55.0.windows.3, significantly enhancing the security of the credential management in Git for Windows.

References