Git for Windows is the Windows port of Git. Prior to 2.53.0(2), it is possible to obtain a user's NTLM hash by tricking them into cloning from a malicious server. Since NTLM hashing is weak, it is possible for the attacker to brute-force the user's account name and password. This vulnerability is fixed in 2.53.0(2).

Just wanted to flag one that might have slipped under yalls radar if you only focus on standard "Patch Tuesday". CVE-2025-66413 affects Git for Windows versions prior to 2.53.0(2). It allows an attacker to grab a user's NTLM hash just by tricking them into cloning a malicious repo. Since Git for Windows doesn't always auto-update through standard corporate channels I had to do some quick checking.

Management thinks we’re good but we're not. Found a bunch of devs running Git from their user profiles, so it never hits inventory. Spot-checked machines and versions all over the place, some pretty outdated. Security flagged the NTLM hash vuln, and everyone assumed Patch Tuesday covered it.

I put together a quick PowerShell script(read only) to help you find vulnerable versions of git.exe in your environment:

powershell $Target = "git.exe" $SearchPaths = @("$env:ProgramFiles", "${env:ProgramFiles(x86)}", "$env:LocalAppData\Programs") Get-ChildItem -Path $SearchPaths -Filter $Target -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, @{Name="Version";Expression={$.VersionInfo.ProductVersion}} Threw the script up here in case it helps anyone else: https://www.cveintel.tech/cve/CVE-2025-66413/

Anyone else dealing with stuff like this?

> EDIT: Fixed the PowerShell formatting for easier copy-pasting.