CVE-2025-48386

{"id": "CVE-2025-48386", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 1.8}]}, "published": "2025-07-08T19:15:43.410", "references": [{"url": "https://github.com/git/git/security/advisories/GHSA-4v56-3xvj-xvfr", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-120"}]}], "descriptions": [{"lang": "en", "value": "Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The wincred credential helper uses a static buffer (target) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with wcsncat(), leading to potential buffer overflows. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1."}, {"lang": "es", "value": "Git es un sistema de control de versiones distribuido, r\u00e1pido y escalable con un conjunto de comandos excepcionalmente completo que proporciona operaciones de alto nivel y acceso completo a los componentes internos. El asistente de credenciales wincred utiliza un b\u00fafer est\u00e1tico (target) como clave \u00fanica para almacenar y comparar con el almacenamiento interno. Este asistente de credenciales no realiza una comprobaci\u00f3n de los l\u00edmites adecuada del espacio disponible en el b\u00fafer antes de a\u00f1adir datos con wcsncat(), lo que puede provocar desbordamientos del b\u00fafer. Esta vulnerabilidad est\u00e1 corregida en las versiones v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1 y v2.50.1."}], "lastModified": "2025-07-10T13:18:53.830", "sourceIdentifier": "security-advisories@github.com"}