Bug 2567465 (CVE-2026-100407)

Summary:	CVE-2026-100407 git: git: Denial of Service via heap buffer overflow in credential helper
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, ehelms, jdelft, jpasqual, jupierce, juwatts, lblicha, lgarciaa, mbiarnes, mhulan, ogajduse, osousa, ppalepu, ppostler, prdhamdh, rchan, rhel-process-autobot, sghai, sidsharm, smallamp, suppawar, vlaad, watson-tool-maintainers, zhunting
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Git's Windows credential helper. When storing credentials that contain both a password and an OAuth refresh token, an incorrect buffer calculation leads to an out-of-bounds memory write. This issue can cause a Denial of Service (DoS) by crashing the credential helper process, and may cause Git to falsely report successful credential storage without saving the OAuth credential.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-05 22:00:03 UTC

Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in contrib/credential/wincred/git-credential-wincred.c uses _scwprintf() to size a formatted wide-character credential buffer without space for the terminating NUL when both password and oauth_refresh_token are present. The operation also passes a byte count to _snwprintf_s() where a wide-character count is required, allowing the terminator to be written one WCHAR past the heap allocation before CredWriteW() persists the credential. The resulting fixed two-byte NUL overwrite can terminate the helper with Windows heap-corruption status and can cause git credential approve to report success even though the OAuth credential was not stored. This issue is fixed in version 2.55.0.windows.3.