CVE-2025-48386

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The wincred credential helper uses a static buffer (target) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with wcsncat(), leading to potential buffer overflows. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-120

Affected software

No affected versions have been published.

Timeline

Published: Jul 8, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-483878.7tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outs CVE-2025-483886.5FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, the application performs insufficient validation of CVE-2025-483897.2FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, FreeScout is vulnerable to deserialization of untrus CVE-2025-48398.1A vulnerability has been found in itwanger paicoding 1.0.0/1.0.1/1.0.2/1.0.3 and classified as problematic. Affected by this vulnerability i CVE-2025-483907.2FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, FreeScout is vulnerable to code injection due to ins CVE-2025-483917.5In JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing permission checks in API CVE-2025-483927.5A vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.3.3 through 1.3.4, from 2.0.1-beta through 2.0.4. Users are recom CVE-2025-483935.7The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attac CVE-2025-483944.7An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited CVE-2025-483954.7An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited CVE-2025-483968.3Arbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS. This security issue has been CVE-2025-483977.1The privileged user could log in without sufficient credentials after enabling an application protocol. This security issue has been fixed i