CVE-2026-100408 · Package
NO FIX YET
Git for Windows' wincred credential helper writes two bytes past a heap buffer when erasing a stored password. An attacker who can trigger a credential erase on a Windows machine can corrupt the helper's memory, and the rejected credential can remain stored.
first public Sep 28, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Windows machines running Git for Windows in the affected range that use the wincred credential helper with stored git credentials. Systems that do not use wincred, or that run Git on Linux or macOS, are not affected. The sources do not say how an attacker would reach the erase path in practice.
Not affected if credential-helper-not-wincred, no-stored-git-credentials, non-windows
Who cares developers, git, windows
git --version on Windows, to see whether it is Git for Windows between 2.43.0.windows.1 and 2.55.0.windows.3git-credential-wincred is configured as the credential helper (git config --show-origin credential.helper)Unknown from the sources.
Git for Windows is the Windows port of Git. From 2.43.0.windows.1 until 2.55.0.windows.3, when a matching git:* credential exists in Windows Credential Manager and a git-credential-wincred erase input includes a password field, the operation in contrib/credential/wincred/git-credential-wincred.c allocates a buffer of exactly CredentialBlobSize bytes in match_cred_password() and then uses wcsncpy_s() to copy the corresponding number of wide characters plus a terminating NUL. The destination capacity is also supplied in bytes instead of WCHAR elements, allowing a fixed two-byte NUL write past the allocation before the password comparison determines whether CredDeleteW() should remove the credential; erase without a password field does not enter this comparison path. The helper can terminate with Windows heap-corruption status, and git credential reject can appear successful while the rejected credential remains stored. This issue is fixed in version 2.55.0.windows.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-100408") · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.