Vulnerability · Published Nov 4, 2026 · Assigned by GitHub_M
CVE-2026-100408Git for Windows: git-credential-wincred Erase Path Heap Overflow
Medium 4.4
In plain English
A medium-severity out-of-bounds write in git from git-for-windows. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Official description
Git for Windows is the Windows port of Git. From 2.43.0.windows.1 until 2.55.0.windows.3, when a matching git:* credential exists in Windows Credential Manager and a git-credential-wincred erase input includes a password field, the operation in contrib/credential/wincred/git-credential-wincred.c allocates a buffer of exactly CredentialBlobSize bytes in match_cred_password() and then uses wcsncpy_s() to copy the corresponding number of wide characters plus a terminating NUL. The destination capacity is also supplied in bytes instead of WCHAR elements, allowing a fixed two-byte NUL write past the allocation before the password comparison determines whether CredDeleteW() should remove the credential; erase without a password field does not enter this comparison path. The helper can terminate with Windows heap-corruption status, and git credential reject can appear successful while the rejected credential remains stored. This issue is fixed in version 2.55.0.windows.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | git | no fix listed | UBUNTU-CVE-2026-100408 |
| Ubuntu:24.04:LTS | git | no fix listed | UBUNTU-CVE-2026-100408 |
| Ubuntu:26.04:LTS | git | no fix listed | UBUNTU-CVE-2026-100408 |
| Ubuntu:26.10 | git | no fix listed | UBUNTU-CVE-2026-100408 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| git-for-windows | git | >= 2.43.0.windows.1, < 2.55.0.windows.3 |
Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L