CVE-2026-100407 · Package
NO FIX YET
Git for Windows' wincred credential helper writes one wide character past a heap buffer when both a password and an OAuth refresh token are stored. The result is a crash with heap-corruption status, and git credential approve can report success while the OAuth credential was not saved.
first public Sep 28, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Only Windows machines running Git for Windows in the affected range, and only when the wincred credential helper stores both a password and an OAuth refresh token. Systems using other credential helpers or managed hosts that do not run the helper locally can skip it.
Not affected if no-oauth-token, non-windows, other-credential-helper
Who cares developers, git, windows
git --version on Windows machines and check whether it is Git for Windows between 2.44.0.windows.1 and 2.55.0.windows.3wincred in git config --show-origin credential.helperUnknown from the sources.
Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in contrib/credential/wincred/git-credential-wincred.c uses _scwprintf() to size a formatted wide-character credential buffer without space for the terminating NUL when both password and oauth_refresh_token are present. The operation also passes a byte count to _snwprintf_s() where a wide-character count is required, allowing the terminator to be written one WCHAR past the heap allocation before CredWriteW() persists the credential. The resulting fixed two-byte NUL overwrite can terminate the helper with Windows heap-corruption status and can cause git credential approve to report success even though the OAuth credential was not stored. This issue is fixed in version 2.55.0.windows.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-100407") · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.