EUVD-2026-64126Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Network vector; no attacker privileges needed; user interaction required for the clone or fetch; scope change because captured NTLM credentials enable authentication against systems beyond the Git client.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file() in bundle-uri.c during clone or fetch when transfer.bundleuri=true. Non-HTTP(S) values are treated as local filesystem paths, and file URI prefixes are removed, so a bare UNC path or file URI targeting an attacker-controlled share causes Windows to initiate an outbound SMB connection. This can expose NTLM authentication material to the attacker-selected host. This issue is fixed in version 2.55.0.windows.4.
AnalysisAI
NTLM credential exposure in Git for Windows before 2.55.0.windows.4 allows a malicious remote Git server to capture Windows authentication material by advertising a crafted bundle URI during clone or fetch operations. When transfer.bundleuri is enabled, non-HTTP(S) URIs including bare UNC paths are treated as local filesystem paths, causing Windows to initiate an outbound SMB connection to an attacker-controlled host and expose NTLM hashes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim has explicitly set transfer.bundleuri=true in their Git configuration-this setting is disabled by default and must be manually enabled by the user or an administrator. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N scores 7.4 High and accurately characterizes the threat: network-reachable, low attack complexity, no attacker privileges required, with a scope change because captured NTLM credentials can authenticate against Active Directory, file servers, and other Windows services far beyond the Git process itself. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Git for Windows version 2.55.0.windows.4 or later, available at https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.4. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running Git for Windows and communicate the credential exposure risk to development teams; within 7 days: deploy Git for Windows 2.55.0.windows.4 or later enterprise-wide and, as interim mitigation if patching cannot complete immediately, disable transfer.bundleuri via organizational Group Policy or configuration management; within 30 days: verify 100% patch compliance across all Git for Windows deployments, review authentication logs for anomalous SMB connection attempts, and implement network controls restricting outbound SMB from development systems.
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
Git contains a CRLF injection vulnerability (CVE-2025-48384, CVSS 8.0) in its config handling that allows attackers to e
Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x be
The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x
Git is an open-source distributed revision control system. Rated high severity (CVSS 7.5), this vulnerability is remotel
Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) ma
The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. Rated critical severity (C
revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary c
contrib/completion/git-prompt.sh in Git before 1.9.3 does not sanitize branch names in the PS1 variable, allowing a mali
Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote
A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds o
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today