Heap Buffer Overflow in Git Affects Multiple Versions

CVE-2026-105437

What is CVE-2026-105437?

The heap buffer overflow vulnerability in Git arises during the three-way merge process, particularly affected by the inappropriate handling of conflict markers in a .gitattributes file. When the size of the output exceeds the buffer limit (4 GiB), it leads to integer overflow, allowing attackers to write past allocated memory spaces. This situation not only crashes the Git application but may also result in severe heap corruption due to the control attackers can exert over the merge output. Specifically, any command that performs a textual three-way merge can trigger this issue. Although a patch has been implemented to rectify the problem by adjusting size calculations to prevent overflow, immediate server-side measures, such as adjusting conflict marker settings or turning off specific merge checks, are advisable for users unable to upgrade promptly.

References