Vulnerability · Published Nov 4, 2026 · Assigned by GitHub_M
CVE-2026-100407Git for Windows: git-credential-wincred OAuth Store Heap Overflow
Medium 4.4
In plain English
A medium-severity out-of-bounds write in git from git-for-windows. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Official description
Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in contrib/credential/wincred/git-credential-wincred.c uses _scwprintf() to size a formatted wide-character credential buffer without space for the terminating NUL when both password and oauth_refresh_token are present. The operation also passes a byte count to _snwprintf_s() where a wide-character count is required, allowing the terminator to be written one WCHAR past the heap allocation before CredWriteW() persists the credential. The resulting fixed two-byte NUL overwrite can terminate the helper with Windows heap-corruption status and can cause git credential approve to report success even though the OAuth credential was not stored. This issue is fixed in version 2.55.0.windows.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | git | no fix listed | UBUNTU-CVE-2026-100407 |
| Ubuntu:24.04:LTS | git | no fix listed | UBUNTU-CVE-2026-100407 |
| Ubuntu:26.04:LTS | git | no fix listed | UBUNTU-CVE-2026-100407 |
| Ubuntu:26.10 | git | no fix listed | UBUNTU-CVE-2026-100407 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| git-for-windows | git | >= 2.44.0.windows.1, < 2.55.0.windows.3 |
Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L