---
id: "CVE-2026-100407"
kind: "vulnerability"
aliases: ["CVE-2026-100407"]
title: "Git for Windows: credential helper heap overflow can corrupt memory on save"
severity: "medium"
cvss: 4.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["developers", "git", "package", "windows"]
not_affected_if: ["no-oauth-token", "non-windows", "other-credential-helper"]
published_at: "2026-11-04T15:17:21+00:00"
first_seen_at: "2026-11-04T15:27:29+00:00"
updated_at: "2026-11-04T15:28:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100407", "first_seen_at": "2026-11-04T15:27:29+00:00"}]
---

# Git for Windows: credential helper heap overflow can corrupt memory on save

Git for Windows' wincred credential helper writes one wide character past a heap buffer when both a password and an OAuth refresh token are stored. The result is a crash with heap-corruption status, and git credential approve can report success while the OAuth credential was not saved.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `git --version` on Windows machines and check whether it is Git for Windows between `2.44.0.windows.1` and `2.55.0.windows.3`
- Check whether the credential helper is set to `wincred` in `git config --show-origin credential.helper`

## Timeline

- 2026-11-04T15:27:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-100407

## Documents

- [advisory] Vendor advisory: github.com https://github.com/git-for-windows/git/security/advisories/GHSA-v3h4-vrpr-rh9x
- [fix] Patch: github.com https://github.com/git-for-windows/git/commit/52ca1113d651127f89477a8763f86ab20f645e1d
- [fix] Release notes: github.com https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3

## From the sources

Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in contrib/credential/wincred/git-credential-wincred.c uses _scwprintf() to size a formatted wide-character credential buffer without space for the terminating NUL when both password and oauth_refresh_token are present. The operation also passes a byte count to _snwprintf_s() where a wide-character count is required, allowing the terminator to be written one WCHAR past the heap allocation before CredWriteW() persists the credential. The resulting fixed two-byte NUL overwrite can terminate the helper with Windows heap-corruption status and can cause git credential approve to report success even though the OAuth credential was not stored. This issue is fixed in version 2.55.0.windows.3.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_