{"id":"CVE-2026-100408","kind":"vulnerability","aliases":["CVE-2026-100408"],"related":[],"title":"Git for Windows: credential helper heap overflow can corrupt memory on erase","description":"Git for Windows is the Windows port of Git. From 2.43.0.windows.1 until 2.55.0.windows.3, when a matching git:* credential exists in Windows Credential Manager and a git-credential-wincred erase input includes a password field, the operation in contrib/credential/wincred/git-credential-wincred.c allocates a buffer of exactly CredentialBlobSize bytes in match_cred_password() and then uses wcsncpy_s() to copy the corresponding number of wide characters plus a terminating NUL. The destination capacity is also supplied in bytes instead of WCHAR elements, allowing a fixed two-byte NUL write past the allocation before the password comparison determines whether CredDeleteW() should remove the credential; erase without a password field does not enter this comparison path. The helper can terminate with Windows heap-corruption status, and git credential reject can appear successful while the rejected credential remains stored. This issue is fixed in version 2.55.0.windows.3.","summary":"Git for Windows' wincred credential helper writes two bytes past a heap buffer when erasing a stored password. An attacker who can trigger a credential erase on a Windows machine can corrupt the helper's memory, and the rejected credential can remain stored.","severity":"medium","cvss":4.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["developers","git","package","windows"],"not_affected_if":["credential-helper-not-wincred","no-stored-git-credentials","non-windows"],"how_to_check":"- `git --version` on Windows, to see whether it is Git for Windows between `2.43.0.windows.1` and `2.55.0.windows.3`\n- Check whether `git-credential-wincred` is configured as the credential helper (`git config --show-origin credential.helper`)","fix":null,"status":"open","published_at":"2026-11-04T15:17:21+00:00","first_seen_at":"2026-11-04T15:27:29+00:00","triaged_at":"2026-11-04T15:28:28+00:00","updated_at":"2026-11-04T15:28:28+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T15:28:28Z","model":"claude-haiku-5-5","output":{"fix":"- Git for Windows: move to `2.55.0.windows.3`","reach":"local","title":"Git for Windows: credential helper heap overflow can corrupt memory on erase","impact":"low","summary":"Git for Windows' wincred credential helper writes two bytes past a heap buffer when erasing a stored password. An attacker who can trigger a credential erase on a Windows machine can corrupt the helper's memory, and the rejected credential can remain stored.","audience":"developers","category":"package","nicknames":[],"who_cares":["git","windows","developers"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"helper process crashes or heap corrupts; stored credential survives rejection","analyst_note":"","how_to_check":"- `git --version` on Windows, to see whether it is Git for Windows between `2.43.0.windows.1` and `2.55.0.windows.3`\n- Check whether `git-credential-wincred` is configured as the credential helper (`git config --show-origin credential.helper`)","plain_action":"","needs_analyst":false,"not_affected_if":["non-windows","credential-helper-not-wincred","no-stored-git-credentials"],"who_is_affected":"Windows machines running Git for Windows in the affected range that use the wincred credential helper with stored git credentials. Systems that do not use wincred, or that run Git on Linux or macOS, are not affected. The sources do not say how an attacker would reach the erase path in practice.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000712,"input_tokens":4370,"output_tokens":549,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-100408':15A,18A '-2026':14A,17A '1':77C '2.43.0.windows':76C '2.55.0.windows':79C,209C '3':80C,210C 'alloc':107C,157C 'allow':147C 'also':139C 'appear':195C 'attack':42B 'buffer':35B,109C 'byte':31B,113C,142C,152C 'capac':137C 'charact':130C 'comparison':161C,178C 'contrib/credential/wincred/git-credential-wincred.c':106C 'copi':124C 'correspond':126C 'corrupt':9A,54B,188C 'cred':116C 'creddeletew':164C 'credenti':4A,27B,47B,62B,85C,89C,95C,168C,192C,200C 'credentialblobs':112C 'cve':13A,16A 'destin':136C 'determin':162C 'develop':19B 'element':146C 'enter':176C 'eras':12A,37B,48B,97C,169C 'exact':111C 'exist':86C 'field':102C,173C 'fix':149C,206C 'git':1A,20B,23B,66C,74C,84C,94C,191C 'git-credential-wincr':93C 'heap':6A,34B,187C 'heap-corrupt':186C 'helper':5A,28B,56B,181C 'includ':99C 'input':98C 'instead':143C 'issu':204C 'machin':52B 'manag':90C 'match':83C,115C 'memori':10A,58B 'nul':134C,153C 'number':127C 'oper':104C 'overflow':7A 'packag':21B 'password':40B,101C,117C,160C,172C 'past':32B,155C 'path':179C 'plus':131C 'port':72C 'reject':61B,193C,199C 'remain':64B,201C 'remov':166C 'status':189C 'store':39B,65B,202C 'success':196C 'suppli':140C 'termin':133C,183C 'trigger':45B 'two':30B,151C 'two-byt':150C 'use':120C 'version':208C 'wchar':145C 'wcsncpi':121C 'whether':163C 'wide':129C 'wincr':26B,96C 'window':3A,22B,25B,51B,68C,71C,88C,185C 'without':170C 'write':29B,154C","nicknames":[],"mitigations":[],"who_affected":"Windows machines running Git for Windows in the affected range that use the wincred credential helper with stored git credentials. Systems that do not use wincred, or that run Git on Linux or macOS, are not affected. The sources do not say how an attacker would reach the erase path in practice.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["developers","git","medium","package","windows"],"campaign_type":null,"first_public_at":"2026-09-28T19:09:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-100408","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100408","severity":null,"published_at":"2026-11-04T15:17:21+00:00","modified_at":"2026-11-04T15:17:21+00:00","first_seen_at":"2026-11-04T15:27:29+00:00","fetched_at":"2026-11-04T15:27:29+00:00","note":null}],"documents":[{"id":67824,"url":"https://github.com/git-for-windows/git/commit/b4d1fb62c7e2fdcab5a018e25e51acb196eb1756","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":67822,"url":"https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":67826,"url":"https://github.com/git-for-windows/git/security/advisories/GHSA-5j7x-r6vf-jhq2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-28T19:09:47+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}