What is the CVSS score of CVE-2025-66413?

CVE-2025-66413 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Microsoft are affected by CVE-2025-66413?

Git for Windows versions before 2.53.0(2) expose NTLM credential hashes to malicious repository servers during clone operations, creating a credential theft risk for development teams.

How to fix or mitigate CVE-2025-66413?

Within 24 hours: Inventory all Git for Windows installations across development environments and identify versions prior to 2.53.0(2). Within 7 days: Implement monitoring for suspicious git clone operations from external sources and restrict developer access to clone only from approved internal repositories. Within 30 days: Upgrade all Git for Windows installations to version 2.53.0(2) or later; validate upgrade completion across all developer workstations and CI/CD pipelines.

Microsoft CVE-2025-66413

HIGH

Information Exposure (CWE-200)

2026-03-10 security-advisories@github.com

Microsoft Information Disclosure

7.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.4 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 21, 2026 - 14:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 21, 2026 - 14:22 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 21:16 nvd

HIGH 7.4

DescriptionGitHub Advisory

Git for Windows is the Windows port of Git. Prior to 2.53.0(2), it is possible to obtain a user's NTLM hash by tricking them into cloning from a malicious server. Since NTLM hashing is weak, it is possible for the attacker to brute-force the user's account name and password. This vulnerability is fixed in 2.53.0(2).

AnalysisAI

Git for Windows versions prior to 2.53.0(2) leak NTLM credential hashes when users clone from malicious servers, enabling password cracking attacks. The vulnerability requires user interaction (cloning from attacker-controlled repository) but needs no authentication from the attacker. EPSS score of 0.03% suggests low probability of mass exploitation, and no evidence of active exploitation or public POC exists at time of analysis. However, the simplicity of the attack (social engineering a git clone operation) and the high confidentiality impact (user credential theft) make this a priority for Windows-based development environments.

Technical ContextAI

Git for Windows is the official Windows port of the Git version control system. This vulnerability exploits the Windows NTLM (NT LAN Manager) authentication protocol, which automatically attempts authentication when connecting to SMB shares or certain network resources. When Git for Windows processes a malicious repository URL or reference containing UNC paths (Universal Naming Convention paths pointing to SMB shares), Windows automatically initiates NTLM authentication, transmitting the user's hashed credentials to the attacker-controlled server. The underlying issue is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) because Git fails to sanitize or warn about network paths that trigger automatic credential transmission. NTLM uses weak cryptographic hashing (MD4-based for NTLMv1, challenge-response for NTLMv2) that is vulnerable to offline brute-force and rainbow table attacks, allowing attackers to recover plaintext passwords from captured hashes. The scope change (S:C) in the CVSS vector indicates the vulnerability affects resources beyond Git itself, specifically the Windows authentication subsystem and the user's domain or local account credentials.

RemediationAI

Upgrade Git for Windows to version 2.53.0(2) or later immediately, available from the official release at https://github.com/git-for-windows/git/releases/tag/v2.53.0.windows.2. The patch prevents Git from automatically following UNC paths or SMB references that trigger NTLM authentication during clone operations. If immediate patching is not feasible, implement compensating controls: (1) Configure Windows Group Policy to disable NTLM authentication globally or restrict it to trusted servers only (EnableSecuritySignature and RestrictSendingNTLMTraffic policies), noting this may break legitimate SMB-based workflows. (2) Train developers to verify repository URLs before cloning and avoid cloning from untrusted sources or URLs containing UNC paths (backslash format or smb:// protocol). (3) Use Git credential managers with token-based authentication instead of Windows Integrated Authentication to prevent automatic credential transmission. (4) Monitor network traffic for outbound SMB connections (port 445) from developer workstations to unexpected external IPs, which may indicate exploitation attempts. Review the official security advisory at https://github.com/git-for-windows/git/security/advisories/GHSA-hv9c-4jm9-jh3x for additional context and detection guidance.