CVE-2025-48386: Git allows a buffer overflow in 'wincred' credential helper

Medium severity · published Jul 8, 2025

CVE-2025-48386

Git allows a buffer overflow in 'wincred' credential helper

6.3

CVSS

0.4%

EPSS

On KEV

Description

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The wincred credential helper uses a static buffer (target) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with wcsncat(), leading to potential buffer overflows. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Attack vector

Local

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

None

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 37% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

git · git

< 2.43.7; >= 2.44.0-rc0, < 2.44.4; >= 2.45.0-rc0, < 2.45.4; >= 2.46.0-rc0, < 2.46.4; >= 2.47.0-rc0, < 2.47.3; >= 2.48.0-rc0, < 2.48.2; +2 more · source: vendor

Affected product

git

All git CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-48386

CVE.org

https://www.cve.org/CVERecord?id=CVE-2025-48386

github.com

https://github.com/git/git/security/advisories/GHSA-4v56-3xvj-xvfr

www.openwall.com

http://www.openwall.com/lists/oss-security/2025/07/08/4