Bug 2567655 (CVE-2026-100408)

Summary:	CVE-2026-100408 git: Git for Windows: Denial of service via heap buffer overflow in git-credential-wincred
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, ehelms, jdelft, jpasqual, jupierce, juwatts, lblicha, lgarciaa, mbiarnes, mhulan, ogajduse, osousa, ppalepu, ppostler, prdhamdh, rchan, rhel-process-autobot, sghai, sidsharm, smallamp, suppawar, vlaad, watson-tool-maintainers, zhunting
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Git for Windows within the git-credential-wincred credential helper. When erasing stored credentials that include a password, the helper calculates buffer sizes incorrectly for wide characters, resulting in a heap-based buffer overflow. An attacker who supplies crafted credential erase input can crash the helper process, leading to a denial of service (DoS). Furthermore, this failure can prevent credentials from being deleted, leaving them unexpectedly stored in Windows Credential Manager.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-05 22:15:32 UTC

Git for Windows is the Windows port of Git. From 2.43.0.windows.1 until 2.55.0.windows.3, when a matching git:* credential exists in Windows Credential Manager and a git-credential-wincred erase input includes a password field, the operation in contrib/credential/wincred/git-credential-wincred.c allocates a buffer of exactly CredentialBlobSize bytes in match_cred_password() and then uses wcsncpy_s() to copy the corresponding number of wide characters plus a terminating NUL. The destination capacity is also supplied in bytes instead of WCHAR elements, allowing a fixed two-byte NUL write past the allocation before the password comparison determines whether CredDeleteW() should remove the credential; erase without a password field does not enter this comparison path. The helper can terminate with Windows heap-corruption status, and git credential reject can appear successful while the rejected credential remains stored. This issue is fixed in version 2.55.0.windows.3.