{"id":"CVE-2026-100407","title":"Git for Windows: git-credential-wincred OAuth Store Heap Overflow","summary":"Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in contrib/credential/wincred/git-credential-wincred.c uses _scwprintf() to size a formatted wide-charac…","severity":"medium","cvss":4.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","cvssSource":"cna","cwe":["CWE-787"],"vendor":"git-for-windows","product":"git","affected":["git >= 2.44.0.windows.1, < 2.55.0.windows.3"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-04T20:41:14.929892Z"},"exploitAvailable":true,"published":"2026-11-04","updated":"2026-11-05","sourceUpdated":"2026-11-05T19:07:18.059Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-100407","references":[{"url":"https://github.com/git-for-windows/git/security/advisories/GHSA-v3h4-vrpr-rh9x","label":"https://github.com/git-for-windows/git/security/advisories/GHSA-v3h4-vrpr-rh9x"},{"url":"https://github.com/git-for-windows/git/commit/52ca1113d651127f89477a8763f86ab20f645e1d","label":"https://github.com/git-for-windows/git/commit/52ca1113d651127f89477a8763f86ab20f645e1d"},{"url":"https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3","label":"https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3"}],"tags":["cve.org","exploit-available"],"epss":0.00117,"epssPercentile":0.01661,"ingestedAt":"2026-11-05T22:38:31.507Z","slug":"CVE-2026-100407","body":"## Overview\n\nGit for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in contrib/credential/wincred/git-credential-wincred.c uses _scwprintf() to size a formatted wide-character credential buffer without space for the terminating NUL when both password and oauth_refresh_token are present. The operation also passes a byte count to _snwprintf_s() where a wide-character count is required, allowing the terminator to be written one WCHAR past the heap allocation before CredWriteW() persists the credential. The resulting fixed two-byte NUL overwrite can terminate the helper with Windows heap-corruption status and can cause git credential approve to report success even though the OAuth credential was not stored. This issue is fixed in version 2.55.0.windows.3.\n\n## Affected\n\n- `git >= 2.44.0.windows.1, < 2.55.0.windows.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":36,"depthScoreParts":{"impact":24.2,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}