CVE-2026-100407

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-100407", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-25T20:08:33.084Z", "datePublished": "2026-11-04T15:07:59.401Z", "dateUpdated": "2026-11-05T19:07:18.059Z"}, "containers": {"cna": {"title": "Git for Windows: git-credential-wincred OAuth Store Heap Overflow", "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "lang": "en", "description": "CWE-787: Out-of-bounds Write", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/git-for-windows/git/security/advisories/GHSA-v3h4-vrpr-rh9x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/git-for-windows/git/security/advisories/GHSA-v3h4-vrpr-rh9x"}, {"name": "https://github.com/git-for-windows/git/commit/52ca1113d651127f89477a8763f86ab20f645e1d", "tags": ["x_refsource_MISC"], "url": "https://github.com/git-for-windows/git/commit/52ca1113d651127f89477a8763f86ab20f645e1d"}, {"name": "https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3"}], "affected": [{"vendor": "git-for-windows", "product": "git", "versions": [{"version": ">= 2.44.0.windows.1, < 2.55.0.windows.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-04T15:07:59.401Z"}, "descriptions": [{"lang": "en", "value": "Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in contrib/credential/wincred/git-credential-wincred.c uses _scwprintf() to size a formatted wide-character credential buffer without space for the terminating NUL when both password and oauth_refresh_token are present. The operation also passes a byte count to _snwprintf_s() where a wide-character count is required, allowing the terminator to be written one WCHAR past the heap allocation before CredWriteW() persists the credential. The resulting fixed two-byte NUL overwrite can terminate the helper with Windows heap-corruption status and can cause git credential approve to report success even though the OAuth credential was not stored. This issue is fixed in version 2.55.0.windows.3."}], "source": {"advisory": "GHSA-v3h4-vrpr-rh9x", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-04T20:41:14.929892Z", "id": "CVE-2026-100407", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:07:18.059Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-100407", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-04T20:41:14.929892Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:07:11.734Z"}}], "cna": {"title": "Git for Windows: git-credential-wincred OAuth Store Heap Overflow", "source": {"advisory": "GHSA-v3h4-vrpr-rh9x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "git-for-windows", "product": "git", "versions": [{"status": "affected", "version": ">= 2.44.0.windows.1, < 2.55.0.windows.3"}]}], "references": [{"url": "https://github.com/git-for-windows/git/security/advisories/GHSA-v3h4-vrpr-rh9x", "name": "https://github.com/git-for-windows/git/security/advisories/GHSA-v3h4-vrpr-rh9x", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/git-for-windows/git/commit/52ca1113d651127f89477a8763f86ab20f645e1d", "name": "https://github.com/git-for-windows/git/commit/52ca1113d651127f89477a8763f86ab20f645e1d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3", "name": "https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in contrib/credential/wincred/git-credential-wincred.c uses _scwprintf() to size a formatted wide-character credential buffer without space for the terminating NUL when both password and oauth_refresh_token are present. The operation also passes a byte count to _snwprintf_s() where a wide-character count is required, allowing the terminator to be written one WCHAR past the heap allocation before CredWriteW() persists the credential. The resulting fixed two-byte NUL overwrite can terminate the helper with Windows heap-corruption status and can cause git credential approve to report success even though the OAuth credential was not stored. This issue is fixed in version 2.55.0.windows.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-04T15:07:59.401Z"}}}, "cveMetadata": {"cveId": "CVE-2026-100407", "state": "PUBLISHED", "dateUpdated": "2026-11-05T19:07:18.059Z", "dateReserved": "2026-09-25T20:08:33.084Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-11-04T15:07:59.401Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "git", "vendor": "git-for-windows", "versions": [{"status": "affected", "version": ">= 2.44.0.windows.1, < 2.55.0.windows.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in contrib/credential/wincred/git-credential-wincred.c uses _scwprintf() to size a formatted wide-character credential buffer without space for the terminating NUL when both password and oauth_refresh_token are present. The operation also passes a byte count to _snwprintf_s() where a wide-character count is required, allowing the terminator to be written one WCHAR past the heap allocation before CredWriteW() persists the credential. The resulting fixed two-byte NUL overwrite can terminate the helper with Windows heap-corruption status and can cause git credential approve to report success even though the OAuth credential was not stored. This issue is fixed in version 2.55.0.windows.3."}], "id": "CVE-2026-100407", "lastModified": "2026-11-12T20:04:52.377", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-100407", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-04T20:41:14.929892Z", "version": "2.0.3"}}]}, "published": "2026-11-04T15:17:21.797", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/git-for-windows/git/commit/52ca1113d651127f89477a8763f86ab20f645e1d"}, {"source": "security-advisories@github.com", "url": "https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/git-for-windows/git/security/advisories/GHSA-v3h4-vrpr-rh9x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "git: git: Denial of Service via heap buffer overflow in credential helper", "id": "2567465", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567465"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "status": "draft"}, "cwe": "CWE-787", "details": ["Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in contrib/credential/wincred/git-credential-wincred.c uses _scwprintf() to size a formatted wide-character credential buffer without space for the terminating NUL when both password and oauth_refresh_token are present. The operation also passes a byte count to _snwprintf_s() where a wide-character count is required, allowing the terminator to be written one WCHAR past the heap allocation before CredWriteW() persists the credential. The resulting fixed two-byte NUL overwrite can terminate the helper with Windows heap-corruption status and can cause git credential approve to report success even though the OAuth credential was not stored. This issue is fixed in version 2.55.0.windows.3.", "A flaw was found in Git's Windows credential helper. When storing credentials that contain both a password and an OAuth refresh token, an incorrect buffer calculation leads to an out-of-bounds memory write. This issue can cause a Denial of Service (DoS) by crashing the credential helper process, and may cause Git to falsely report successful credential storage without saving the OAuth credential."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-100407", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Under investigation", "package_name": "git", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Under investigation", "package_name": "git", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Under investigation", "package_name": "git", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Under investigation", "package_name": "git", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Under investigation", "package_name": "git", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Under investigation", "package_name": "git", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Under investigation", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Under investigation", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Under investigation", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Under investigation", "package_name": "rubygem-git", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-11-04T15:07:59Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-100407\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-100407\nhttps://github.com/git-for-windows/git/commit/52ca1113d651127f89477a8763f86ab20f645e1d\nhttps://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3\nhttps://github.com/git-for-windows/git/security/advisories/GHSA-v3h4-vrpr-rh9x"], "statement": "This vulnerability is classified as having a Moderate impact because it is restricted to local execution and results in a denial of service without exposing sensitive data or granting elevated privileges. Red Hat Enterprise Linux and containerized distributions do not package or run the Windows-specific credential helper containing this flaw. Consequently, supported Red Hat platforms are not exposed to this issue.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.44.0.windows.1,2.55.0.windows.3)"}}], "enrichment": {"confidence": 94.0, "confidence_source": "matching", "scores": [{"score": 94.0, "source": "matching"}]}, "original": {"product": "git", "source": "cna", "vendor": "git-for-windows"}, "product": "git", "vendor": "gitforwindows"}], "created": "2026-11-04T16:30:13.004601+00:00", "updated": "2026-11-06T16:30:07.069347+00:00", "vendors": ["gitforwindows", "gitforwindows$PRODUCT$git"]}