---
id: "CVE-2026-100408"
kind: "vulnerability"
aliases: ["CVE-2026-100408"]
title: "Git for Windows: credential helper heap overflow can corrupt memory on erase"
severity: "medium"
cvss: 4.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["developers", "git", "package", "windows"]
not_affected_if: ["credential-helper-not-wincred", "no-stored-git-credentials", "non-windows"]
published_at: "2026-11-04T15:17:21+00:00"
first_seen_at: "2026-11-04T15:27:29+00:00"
updated_at: "2026-11-04T15:28:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100408", "first_seen_at": "2026-11-04T15:27:29+00:00"}]
---

# Git for Windows: credential helper heap overflow can corrupt memory on erase

Git for Windows' wincred credential helper writes two bytes past a heap buffer when erasing a stored password. An attacker who can trigger a credential erase on a Windows machine can corrupt the helper's memory, and the rejected credential can remain stored.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `git --version` on Windows, to see whether it is Git for Windows between `2.43.0.windows.1` and `2.55.0.windows.3`
- Check whether `git-credential-wincred` is configured as the credential helper (`git config --show-origin credential.helper`)

## Timeline

- 2026-11-04T15:27:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-100408

## Documents

- [advisory] Vendor advisory: github.com https://github.com/git-for-windows/git/security/advisories/GHSA-5j7x-r6vf-jhq2
- [fix] Patch: github.com https://github.com/git-for-windows/git/commit/b4d1fb62c7e2fdcab5a018e25e51acb196eb1756
- [fix] Release notes: github.com https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3

## From the sources

Git for Windows is the Windows port of Git. From 2.43.0.windows.1 until 2.55.0.windows.3, when a matching git:* credential exists in Windows Credential Manager and a git-credential-wincred erase input includes a password field, the operation in contrib/credential/wincred/git-credential-wincred.c allocates a buffer of exactly CredentialBlobSize bytes in match_cred_password() and then uses wcsncpy_s() to copy the corresponding number of wide characters plus a terminating NUL. The destination capacity is also supplied in bytes instead of WCHAR elements, allowing a fixed two-byte NUL write past the allocation before the password comparison determines whether CredDeleteW() should remove the credential; erase without a password field does not enter this comparison path. The helper can terminate with Windows heap-corruption status, and git credential reject can appear successful while the rejected credential remains stored. This issue is fixed in version 2.55.0.windows.3.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_