CVE-2026-100408
Received Received - Intake

Heap Corruption in Git for Windows Credential Manager

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description
Git for Windows is the Windows port of Git. From 2.43.0.windows.1 until 2.55.0.windows.3, when a matching git:* credential exists in Windows Credential Manager and a git-credential-wincred erase input includes a password field, the operation in contrib/credential/wincred/git-credential-wincred.c allocates a buffer of exactly CredentialBlobSize bytes in match_cred_password() and then uses wcsncpy_s() to copy the corresponding number of wide characters plus a terminating NUL. The destination capacity is also supplied in bytes instead of WCHAR elements, allowing a fixed two-byte NUL write past the allocation before the password comparison determines whether CredDeleteW() should remove the credential; erase without a password field does not enter this comparison path. The helper can terminate with Windows heap-corruption status, and git credential reject can appear successful while the rejected credential remains stored. This issue is fixed in version 2.55.0.windows.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-100408
EUVD
EUVD-2026-116937

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
git-for-windows git >= 2.43.0.windows.1, < 2.55.0.windows.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap overflow in Git for Windows' git-credential-wincred helper. When erasing a stored credential with a password field, the helper allocates a buffer based on byte size but uses a character count for copying. This causes wcsncpy_s() to write an extra 2-byte NUL past the allocated buffer before comparing passwords. The overflow triggers Windows heap corruption, crashing the helper before it can delete the credential.

Detection Guidance

This vulnerability is specific to Git for Windows versions 2.43.0.windows.1 through 2.55.0.windows.3 and requires checking the installed version. Run 'git --version' to verify your Git for Windows version. If you are using a vulnerable version, the issue can be detected by monitoring crashes of the git-credential-wincred helper during credential operations.

Impact Analysis

The impact is limited. The vulnerability causes the credential helper to crash with heap corruption when attempting to erase a credential with a password field. While the crash is confirmed, no code execution, privilege escalation, or credential disclosure was demonstrated. The rejected credential may remain stored despite the apparent success of the erase command.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it does not involve unauthorized data access, disclosure, or processing of personal data. The issue is a local heap overflow in Git's credential helper that could cause crashes but does not lead to credential disclosure or privilege escalation.

Mitigation Strategies

Upgrade Git for Windows to version 2.55.0.windows.3 or later immediately. This version includes the fix for the heap overflow in the git-credential-wincred helper. No other mitigation steps are required as the issue is resolved by the update.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100408. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...