CVE-2026-100407: Git for Windows: git-credential-wincred OAuth Store Heap Overflow
Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in contrib/credential/wincred/git-credential-wincred.c uses scwprintf() to size a formatted wide-character credential buffer without space for the terminating NUL when both password and oauthrefreshtoken are present. The operation also passes a byte count to snwprintfs() where a wide-character count is required, allowing the terminator to be written one WCHAR past the heap allocation before CredWriteW() persists the credential. The resulting fixed two-byte NUL overwrite can terminate the helper with Windows heap-corruption status and can cause git credential approve to report success even though the OAuth credential was not stored. This issue is fixed in version 2.55.0.windows.3.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Git for Windowsto a version that resolves this vulnerability.Fixed in 2.55.0.windows.3
Event History
Frequently Asked Questions
Which systems and workflows are affected?
Git for Windows installations from 2.44.0.windows.1 through 2.55.0.windows.3 are affected when the git-credential-wincred helper performs a store operation for a credential containing both a password and an oauth_refresh_token.
Does exploitation require an authenticated attacker or user interaction?
The supplied vector indicates local attack access, low complexity, no privileges required, and user interaction is required. The issue occurs during the credential helper's store operation rather than during ordinary credential retrieval.
What is the practical impact?
The helper can terminate with a Windows heap-corruption status because of a fixed two-byte NUL overwrite. Git credential approve may report success even though the OAuth credential was not actually persisted.
What version should be deployed to remediate the issue?
Update Git for Windows to version 2.55.0.windows.3, which is identified as the fixed version.