Buffer Overflow Vulnerability in Git Credential Helper
Summary
ALPINE-CVE-2025-48386: Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Affects git versions < 2.43.7-r0. Fixed in 2.43.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Git is a widely used distributed version control system that allows developers to track changes in source code during software development. It is known for its speed, scalability, and rich command set, enabling both high-level operations and deep access to its internals. The wincred credential helper in Git is designed to securely store credentials for Windows users. However, it has been found to have a critical vulnerability that can lead to buffer overflow issues.
Vulnerability Detail
The vulnerability arises from the wincred credential helper's use of a static buffer as a unique key for storing and comparing against internal storage. The function wcsncat() is used to append data to this buffer without proper bounds checking, which can lead to potential buffer overflows. This flaw can be exploited by attackers to execute arbitrary code or crash the application, posing significant security risks.
How To Fix
Minimum fixed version
2.43.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the wincred credential helper until the package is updated. This can be done by configuring Git to use a different credential helper or by managing credentials manually.
Conclusion
In summary, the buffer overflow vulnerability in the Git wincred credential helper poses significant security risks. It is crucial for users to update to the patched versions of Git to mitigate these risks. Additionally, users can utilize Vulert to monitor and alert for open-source vulnerabilities in their software.
See every vulnerability recorded for git →
FAQ
The vulnerability is a buffer overflow issue in the wincred credential helper of Git, which can lead to arbitrary code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability can allow attackers to execute arbitrary code, potentially compromising the security of the system.
Yes, you can temporarily avoid using the wincred credential helper and manage credentials manually or use an alternative credential helper.
Detailed information about the vulnerability can be found in the CVE record for CVE-2025-48386.
References
Related vulnerabilities
Recent vulnerabilities recorded for git.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
