CVE-2025-48386

What it actually does

The wincred credential helper in Git fails to bounds-check the static buffer used as a key for credential storage before calling wcsncat, resulting in a buffer overflow on Windows.

Why it matters to the business

Attackers could potentially steal stored credentials or execute arbitrary code on developer workstations running vulnerable Git versions on Windows, leading to supply chain risks or data breaches.

How an attack unfolds

An attacker with local access crafts a malicious credential or triggers the helper in a way that overflows the buffer during credential operations, potentially overwriting memory to achieve code execution.

How to fix it

Update Git to one of the fixed versions: v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, or v2.50.1.

How to confirm the fix worked

Verify Git version is updated and test credential operations with the wincred helper.

Typical attack path

1. Gain local access to a Windows system with vulnerable Git
2. Trigger credential helper operations with oversized input
3. Exploit buffer overflow for memory corruption or code execution

How to detect it

Review system logs for unexpected crashes or memory errors during Git credential operations; look for unusual processes spawned from Git.

What your security team should do

• Prioritize updating Git on all Windows developer machines
• Monitor for any unusual credential access attempts
• Consider disabling wincred helper if not needed