CVE-2026-100407
Received Received - Intake

Git Credential Wincred Heap Corruption in Git for Windows

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description
Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in contrib/credential/wincred/git-credential-wincred.c uses _scwprintf() to size a formatted wide-character credential buffer without space for the terminating NUL when both password and oauth_refresh_token are present. The operation also passes a byte count to _snwprintf_s() where a wide-character count is required, allowing the terminator to be written one WCHAR past the heap allocation before CredWriteW() persists the credential. The resulting fixed two-byte NUL overwrite can terminate the helper with Windows heap-corruption status and can cause git credential approve to report success even though the OAuth credential was not stored. This issue is fixed in version 2.55.0.windows.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-100407
EUVD
EUVD-2026-116936

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
git-for-windows git >= 2.44.0.windows.1, < 2.55.0.windows.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100407 is a heap overflow vulnerability in Git for Windows' git-credential-wincred OAuth store component. It occurs when storing credentials containing both a password and an oauth_refresh_token. The issue involves incorrect buffer size calculations where the code writes one WCHAR past the allocated heap memory due to a mismatch between character and byte counts in formatting functions.

Detection Guidance

Detecting this vulnerability requires checking the Git for Windows version installed. Run 'git --version' in Command Prompt or PowerShell. If the version is between 2.44.0.windows.1 and 2.54.0.windows.1, the system is vulnerable. Additionally, monitor for crashes in git-credential-wincred during credential storage operations.

Impact Analysis

This vulnerability can cause the git credential helper to crash with Windows heap-corruption errors. It may also silently fail to store OAuth credentials, leading to repeated authentication prompts even after successful approval. Users might experience local helper crashes and persistent credential storage failures.

Mitigation Strategies

Upgrade Git for Windows to version 2.55.0.windows.3 or later. Download the update from the official Git for Windows releases page and verify the SHA-256 checksum. After updating, restart any active Git sessions to ensure the patched version is used.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100407. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...