git-for-windows vulnerabilities

CVEs per yearBy the year they were published

1. 20222
2. 20236
3. 20265

Newest CVEs

• CVE-2026-100408

  Git for Windows: git-credential-wincred Erase Path Heap Overflow

  git-for-windows · git

  Medium4.4
• CVE-2026-100407

  Git for Windows: git-credential-wincred OAuth Store Heap Overflow

  git-for-windows · git

  Medium4.4
• CVE-2026-62960

  Git for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on Windows

  git-for-windows · git

  High7.4
• CVE-2026-32631

  Git for Windows: `git clone` from manipulated repositories can leak NTLM hashes to arbitrary servers

  git-for-windows · git

  High7.4
• CVE-2025-66413

  Git for Windows leaks NTLM hash when cloning from an attacker-controlled server

  git-for-windows · git

  High7.4
• CVE-2023-29012

  Git CMD erroneously executes `doskey.exe` in the current directory, if it exists

  git-for-windows · git

  High7.3
• CVE-2023-29011

  Git for Windows's config file of `connect.exe` is susceptible to malicious placing

  git-for-windows · git

  High7.6
• CVE-2023-25815

  Git looks for localized messages in the wrong place

  git-for-windows · git

  Low3.3
• CVE-2023-22743

  Git for Windows' installer is susceptible to DLL side loading attacks

  git-for-windows · git

  High7.3
• CVE-2023-23618

  gitk can inadvertently call executables in the worktree

  git-for-windows · git

  High8.6