{"id":"CVE-2026-100407","kind":"vulnerability","aliases":["CVE-2026-100407"],"related":[],"title":"Git for Windows: credential helper heap overflow can corrupt memory on save","description":"Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in contrib/credential/wincred/git-credential-wincred.c uses _scwprintf() to size a formatted wide-character credential buffer without space for the terminating NUL when both password and oauth_refresh_token are present. The operation also passes a byte count to _snwprintf_s() where a wide-character count is required, allowing the terminator to be written one WCHAR past the heap allocation before CredWriteW() persists the credential. The resulting fixed two-byte NUL overwrite can terminate the helper with Windows heap-corruption status and can cause git credential approve to report success even though the OAuth credential was not stored. This issue is fixed in version 2.55.0.windows.3.","summary":"Git for Windows' wincred credential helper writes one wide character past a heap buffer when both a password and an OAuth refresh token are stored. The result is a crash with heap-corruption status, and git credential approve can report success while the OAuth credential was not saved.","severity":"medium","cvss":4.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["developers","git","package","windows"],"not_affected_if":["no-oauth-token","non-windows","other-credential-helper"],"how_to_check":"- Run `git --version` on Windows machines and check whether it is Git for Windows between `2.44.0.windows.1` and `2.55.0.windows.3`\n- Check whether the credential helper is set to `wincred` in `git config --show-origin credential.helper`","fix":null,"status":"open","published_at":"2026-11-04T15:17:21+00:00","first_seen_at":"2026-11-04T15:27:29+00:00","triaged_at":"2026-11-04T15:28:36+00:00","updated_at":"2026-11-04T15:28:36+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T15:28:36Z","model":"claude-haiku-5-5","output":{"fix":"- Git for Windows: move to `2.55.0.windows.3` or later","reach":"local","title":"Git for Windows: credential helper heap overflow can corrupt memory on save","impact":"low","summary":"Git for Windows' wincred credential helper writes one wide character past a heap buffer when both a password and an OAuth refresh token are stored. The result is a crash with heap-corruption status, and git credential approve can report success while the OAuth credential was not saved.","audience":"developers","category":"package","nicknames":[],"who_cares":["git","windows","developers"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"helper crashes with heap corruption; OAuth credential silently not saved","analyst_note":"","how_to_check":"- Run `git --version` on Windows machines and check whether it is Git for Windows between `2.44.0.windows.1` and `2.55.0.windows.3`\n- Check whether the credential helper is set to `wincred` in `git config --show-origin credential.helper`","plain_action":"","needs_analyst":false,"not_affected_if":["non-windows","other-credential-helper","no-oauth-token"],"who_is_affected":"Only Windows machines running Git for Windows in the affected range, and only when the wincred credential helper stores both a password and an OAuth refresh token. Systems using other credential helpers or managed hosts that do not run the helper locally can skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000697,"input_tokens":4321,"output_tokens":529,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-100407':15A,18A '-2026':14A,17A '1':83C '2.44.0.windows':82C '2.55.0.windows':85C,198C '3':86C,199C 'alloc':151C 'allow':140C 'also':124C 'approv':61B,180C 'buffer':36B,106C 'byte':127C,162C 'caus':177C 'charact':32B,104C,136C 'contrib/credential/wincred/git-credential-wincred.c':95C 'corrupt':9A,56B,173C 'count':128C,137C 'crash':52B 'credenti':4A,27B,60B,68B,90C,105C,156C,179C,188C 'credwritew':153C 'cve':13A,16A 'develop':19B 'even':184C 'fix':159C,195C 'format':101C 'git':1A,20B,23B,59B,72C,80C,89C,178C 'git-credential-wincr':88C 'heap':6A,35B,55B,150C,172C 'heap-corrupt':54B,171C 'helper':5A,28B,168C 'issu':193C 'memori':10A 'nul':112C,163C 'oauth':43B,67B,117C,187C 'one':30B,146C 'oper':93C,123C 'overflow':7A 'overwrit':164C 'packag':21B 'pass':125C 'password':40B,115C 'past':33B,148C 'persist':154C 'port':78C 'present':121C 'refresh':44B,118C 'report':63B,182C 'requir':139C 'result':49B,158C 'save':12A,71B 'scwprintf':97C 'size':99C 'snwprintf':130C 'space':108C 'status':57B,174C 'store':47B,92C,191C 'success':64B,183C 'termin':111C,142C,166C 'though':185C 'token':45B,119C 'two':161C 'two-byt':160C 'use':96C 'version':197C 'wchar':147C 'wide':31B,103C,135C 'wide-charact':102C,134C 'wincr':26B,91C 'window':3A,22B,25B,74C,77C,170C 'without':107C 'write':29B 'written':145C","nicknames":[],"mitigations":[],"who_affected":"Only Windows machines running Git for Windows in the affected range, and only when the wincred credential helper stores both a password and an OAuth refresh token. Systems using other credential helpers or managed hosts that do not run the helper locally can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["developers","git","medium","package","windows"],"campaign_type":null,"first_public_at":"2026-09-28T19:10:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-100407","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100407","severity":null,"published_at":"2026-11-04T15:17:21+00:00","modified_at":"2026-11-04T15:17:21+00:00","first_seen_at":"2026-11-04T15:27:29+00:00","fetched_at":"2026-11-04T15:27:29+00:00","note":null}],"documents":[{"id":67821,"url":"https://github.com/git-for-windows/git/commit/52ca1113d651127f89477a8763f86ab20f645e1d","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":67822,"url":"https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":67823,"url":"https://github.com/git-for-windows/git/security/advisories/GHSA-v3h4-vrpr-rh9x","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-28T19:10:19+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}