CVE-2026-100408

Git for Windows is the Windows port of Git. From 2.43.0.windows.1 until 2.55.0.windows.3, when a matching git:* credential exists in Windows Credential Manager and a git-credential-wincred erase input includes a password field, the operation in contrib/credential/wincred/git-credential-wincred.c allocates a buffer of exactly CredentialBlobSize bytes in match_cred_password() and then uses wcsncpy_s() to copy the corresponding number of wide characters plus a terminating NUL. The destination capacity is also supplied in bytes instead of WCHAR elements, allowing a fixed two-byte NUL write past the allocation before the password comparison determines whether CredDeleteW() should remove the credential; erase without a password field does not enter this comparison path. The helper can terminate with Windows heap-corruption status, and git credential reject can appear successful while the rejected credential remains stored. This issue is fixed in version 2.55.0.windows.3.

• CWE-787

• https://github.com/git-for-windows/git/commit/b4d1fb62c7e2fdcab5a018e25e51acb196eb1756
• https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3
• https://github.com/git-for-windows/git/security/advisories/GHSA-5j7x-r6vf-jhq2

Published

Nov 4, 2026

Last Modified

Nov 4, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100392InvoicePlane is a self-hosted open source application for ma…7
• CVE-2026-100394Nezha Monitoring is a self-hostable, lightweight, servers an…6.5
• CVE-2026-1004The Essential Addons for Elementor plugin for WordPress is v…5.3
• CVE-2026-100404Zulip is an open-source team collaboration tool. In Zulip Se…6.5
• CVE-2026-100406dbt enables data analysts and engineers to transform their d…8.2
• CVE-2026-100407Git for Windows is the Windows port of Git. From 2.44.0.wind…4.4
• CVE-2026-100409OpenNext Cloudflare is an open Next.js adapter for Cloudflar…7.5
• CVE-2026-10041The WCFM – Frontend Manager for WooCommerce plugin for WordP…4.3
• CVE-2026-100413SeaweedFS is a distributed storage system for files and blob…7.1
• CVE-2026-100417RustDesk before 1.5.0 on Windows fails to enforce the one-wa…3.1
• CVE-2026-100418Flame through 2.4.0 contains an information exposure vulnera…5.3
• CVE-2026-100419gitoxide gix-fs before 0.23.0 contains a path validation byp…7