The vulnerability is a heap overflow in the git‑credential‑wincred store operation in Git for Windows. When a user stores a credential that includes both a password and an OAuth refresh token, the helper incorrectly calculates the size of a wide‑character buffer and writes the terminating NUL character one wide character past the allocated heap edge. This overrun can corrupt the heap, causing git credential approve to report success even though the OAuth credential was never written. The impact is local heap corruption and a logical error that may allow credentials to be mis‑reported as stored.

The problem exists in Git for Windows build numbers 2.44.0.windows.1 through the latest pre‑fix release. It is fixed in build 2.55.0.windows.3. All users deploying Git for Windows in that range who use the git‑credential‑wincred helper to persist OAuth credentials are impacted.

The CVSS score of 4.4 indicates moderate severity. Exploitation requires local execution of the Git credential helper with a payload that contains both credential fields. No network attack vector is documented, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. Nonetheless, a local attacker can trigger heap corruption or cause a denial of service on the user’s machine by manipulating stored credentials.