---
id: CVE-2026-100408
title: 'Git for Windows: git-credential-wincred Erase Path Heap Overflow'
summary: >-
  Git for Windows is the Windows port of Git. From 2.43.0.windows.1 until
  2.55.0.windows.3, when a matching git:* credential exists in Windows
  Credential Manager and a git-credential-wincred erase input includes a
  password field, the opera…
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-787
vendor: git-for-windows
product: git
affected:
  - 'git >= 2.43.0.windows.1, < 2.55.0.windows.3'
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T15:12:10.794Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-100408'
references:
  - url: >-
      https://github.com/git-for-windows/git/security/advisories/GHSA-5j7x-r6vf-jhq2
    label: >-
      https://github.com/git-for-windows/git/security/advisories/GHSA-5j7x-r6vf-jhq2
  - url: >-
      https://github.com/git-for-windows/git/commit/b4d1fb62c7e2fdcab5a018e25e51acb196eb1756
    label: >-
      https://github.com/git-for-windows/git/commit/b4d1fb62c7e2fdcab5a018e25e51acb196eb1756
  - url: 'https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3'
    label: 'https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3'
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.403Z'
---

## Overview

Git for Windows is the Windows port of Git. From 2.43.0.windows.1 until 2.55.0.windows.3, when a matching git:* credential exists in Windows Credential Manager and a git-credential-wincred erase input includes a password field, the operation in contrib/credential/wincred/git-credential-wincred.c allocates a buffer of exactly CredentialBlobSize bytes in match_cred_password() and then uses wcsncpy_s() to copy the corresponding number of wide characters plus a terminating NUL. The destination capacity is also supplied in bytes instead of WCHAR elements, allowing a fixed two-byte NUL write past the allocation before the password comparison determines whether CredDeleteW() should remove the credential; erase without a password field does not enter this comparison path. The helper can terminate with Windows heap-corruption status, and git credential reject can appear successful while the rejected credential remains stored. This issue is fixed in version 2.55.0.windows.3.

## Affected

- `git >= 2.43.0.windows.1, < 2.55.0.windows.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.