Git allows a buffer overflow in 'wincred' credential helper (git git)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.43 % · percentile 37 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Deferred
Description
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The wincred credential helper uses a static buffer (target) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with wcsncat(), leading to potential buffer overflows. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.
Weaknesses (CWE)
- CWE-120 — Buffer Copy without Checking Size of Input
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.3 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N | GitHub_M |
| CVSS 3.1 | MEDIUM 6.3 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N | NVD · security-advisories@github.com (Secondary) |
European references
- ENISA EUVD · EUVD-2025-20679
- GCVE · GCVE-0-2025-48386
CERT-FR advisories
- CERTFR-2025-AVI-0579 — Multiples vulnérabilités dans les produits Microsoft · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| git · git | affected < 2.43.7 ; affected >= 2.44.0-rc0, < 2.44.4 ; affected >= 2.45.0-rc0, < 2.45.4 ; affected >= 2.46.0-rc0, < 2.46.4 ; affected >= 2.47.0-rc0, < 2.47.3 ; affected >= 2.48.0-rc0, < 2.48.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |