CVE-2026-100408— Git for Windows: git-credential-wincred Erase Path Heap Overflow

Quick assessment

Affected

git-for-windows git

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Git for Windows 是 Git 在 Windows 平台上的移植版本。在从 2.43.0.windows.1 到 2.55.0.windows.3 的版本范围内，当 Windows 凭据管理器中存在匹配的类型凭据，且命令的输入中包含密码字段时，中的函数会分配一个大小恰好为字节的缓冲区，随后使用将对应数量的宽字符以及一个终止的空字符（NUL）复制到该缓冲区中。然而，目标容量参数被错误地以字节为单位传入，而非以元素为单位，导致在密码比较（用于判断是否应调用删除该凭据）之前，会向缓冲区末尾固定

CVSS 4.4 · Medium Updated Nov 04, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
git-for-windows	git	`>= 2.43.0.windows.1, < 2.55.0.windows.3`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Git for Windows: git-credential-wincred Erase Path Heap Overflow

Source: CVE Program / CVE List V5

Vulnerability Description

Git for Windows is the Windows port of Git. From 2.43.0.windows.1 until 2.55.0.windows.3, when a matching git:* credential exists in Windows Credential Manager and a git-credential-wincred erase input includes a password field, the operation in contrib/credential/wincred/git-credential-wincred.c allocates a buffer of exactly CredentialBlobSize bytes in match_cred_password() and then uses wcsncpy_s() to copy the corresponding number of wide characters plus a terminating NUL. The destination capacity is also supplied in bytes instead of WCHAR elements, allowing a fixed two-byte NUL write past the allocation before the password comparison determines whether CredDeleteW() should remove the credential; erase without a password field does not enter this comparison path. The helper can terminate with Windows heap-corruption status, and git credential reject can appear successful while the rejected credential remains stored. This issue is fixed in version 2.55.0.windows.3.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存写

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
git-for-windows	git	>= 2.43.0.windows.1, < 2.55.0.windows.3	-

II. Public POCs for CVE-2026-100408

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-100408

请登录查看更多情报信息。

Other References for CVE-2026-100408 (3)

https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3 x_refsource_MISC
https://github.com/git-for-windows/git/security/advisories/GHSA-5j7x-r6vf-jhq2 x_refsource_CONFIRM
https://github.com/git-for-windows/git/commit/b4d1fb62c7e2fdcab5a018e25e51acb196eb1756 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-100408

IV. Related Vulnerabilities

Same product: git

Same vendor: git-for-windows

Same weakness: CWE-787