SB2026092904 - Multiple vulnerabilities in Git for Windows

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026092904

SB2026092904 - Multiple vulnerabilities in Git for Windows

Published: September 29, 2026 Updated: September 30, 2026

Security Bulletin ID SB2026092904
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 67% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Externally Controlled Reference to a Resource in Another Sphere (CVE-ID: CVE-2026-62960)

CWE-ID: CWE-610 - Externally Controlled Reference to a Resource in Another Sphere

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an externally controlled reference to a resource in another sphere in the bundle-uri feature when cloning from a malicious remote server. A remote attacker can advertise a crafted UNC or file:// bundle URI to disclose sensitive information.

User interaction is required to clone from the malicious remote, and exploitation requires transfer.bundleuri=true.


2) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service and prevent a rejected credential from being removed.

The vulnerability exists due to a heap-based buffer overflow in the match_cred_password() function of git-credential-wincred when comparing a supplied password with a saved Windows Credential Manager CredentialBlob during credential erasure. A remote attacker can cause a victim to initiate credential rejection for a target with a saved credential to cause a denial of service and prevent a rejected credential from being removed.

The overwrite consists of a fixed two-byte NUL value.


3) Heap-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service and prevent OAuth credentials from being persisted.

The vulnerability exists due to a heap-based buffer overflow in the OAuth credential formatting logic of git-credential-wincred when storing an OAuth credential containing an oauth_refresh_token. A remote attacker can cause a victim to store an OAuth credential containing a refresh token to cause a denial of service and prevent OAuth credentials from being persisted.

The overwrite consists of a fixed two-byte NUL value.


Remediation

Install update from vendor's website.

References