CVE-2025-48386 is regarding a vulnerability in Git where the wincred credential helper uses a static buffer (target) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with wcsncat(), leading to potential buffer overflows. GitHub created this CVE on their behalf. The documented Visual Studio updates incorporate updates in Git which address this vulnerability.
Please see CVE-2025-48386 for more information.
\n", "title": "microsoft - https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2025-Jul" }, { "category": "description", "text": "Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The wincred credential helper uses a static buffer (target) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with wcsncat(), leading to potential buffer overflows. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.", "title": "nvd - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-48386" }, { "category": "description", "text": "This update for git fixes the following issues:\n\nUpdate to 2.51.0:\n\n- CVE-2025-27613: arbitrary writable file creation and truncation in Gitk (bsc#1245938)\n- CVE-2025-27614: arbitrary script execution via repo clonation in gitk (bsc#1245939)\n- CVE-2025-46835: untrusted repository cloning can lead to arbitrary writable file creation in Git GUI (bsc#1245942)\n- CVE-2025-48384: script may be unintentionally executed after checkout due to CRLF transforming (bsc#1245943)\n- CVE-2025-48385: arbitrary code execution due to protocol injection via fetching advertised bundle (bsc#1245946)\n- CVE-2025-48386: buffer overflow in static buffer 'target' in wincred credential helper (bsc#1245947)\n", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/SUSE%2FSUSE-SU-2025:20855-1.json?alt=media" }, { "category": "description", "text": "This update for git fixes the following issues:\n\n- Update to 2.51.0\n \n - UI, Workflows & Features\n - Userdiff patterns for the R language have been added.\n - Documentation for \"git send-email\" has been updated with a\n bit more credential helper and OAuth information.\n - \"git cat-file --batch\" learns to understand %(objectmode)\n atom to allow the caller to tell missing objects (due to\n repository corruption) and submodules (whose commit objects\n are OK to be missing) apart.\n - \"git diff --no-index dirA dirB\" can limit the comparison with\n pathspec at the end of the command line, just like normal\n \"git diff\".\n - \"git subtree\" (in contrib/) learned to grok GPG signing its\n commits.\n - \"git whatchanged\" that is longer to type than \"git log --raw\"\n which is its modern rough equivalent has outlived its\n usefulness more than 10 years ago. Plan to deprecate and\n remove it.\n - An interchange format for stash entries is defined, and\n subcommand of \"git stash\" to import/export has been added.\n - \"git merge/pull\" has been taught the \"--compact-summary\"\n option to use the compact-summary format, intead of diffstat,\n when showing the summary of the incoming changes.\n - \"git imap-send\" has been broken for a long time, which has\n been resurrected and then taught to talk OAuth2.0 etc.\n - Some error messages from \"git imap-send\" has been updated.\n - When \"git daemon\" sees a signal while attempting to accept()\n a new client, instead of retrying, it skipped it by mistake,\n which has been corrected.\n - The reftable ref backend has matured enough; Git 3.0 will\n make it the default format in a newly created repositories by\n default.\n - \"netrc\" credential helper has been improved to understand\n textual service names (like smtp) in addition to the numeric\n port numbers (like 25).\n - Lift the limitation to use changed-path filter in \"git log\"\n so that it can be used for a pathspec with multiple literal\n paths.\n - Clean up the way how signature on commit objects are exported\n to and imported from fast-import stream.\n - Remove unsupported, unused, and unsupportable old option from\n \"git log\".\n - Document recently added \"git imap-send --list\" with an\n example.\n - \"git pull\" learned to pay attention to pull.autostash\n configuration variable, which overrides\n rebase/merge.autostash.\n - \"git for-each-ref\" learns \"--start-after\" option to help\n applications that want to page its output.\n - \"git switch\" and \"git restore\" are declared to be no longer\n experimental.\n - \"git -c alias.foo=bar foo -h baz\" reported \"'foo' is aliased\n to 'bar'\" and then went on to run \"git foo -h baz\", which was\n unexpected. Tighten the rule so that alias expansion is\n reported only when \"-h\" is the sole option.\n - Performance, Internal Implementation, Development Support etc.\n - \"git pack-objects\" learned to find delta bases from blobs at\n the same path, using the --path-walk API.\n - CodingGuidelines update.\n - Add settings for Solaris 10 & 11.\n - Meson-based build/test framework now understands TAP output\n generated by our tests.\n - \"Do not explicitly initialize to zero\" rule has been\n clarified in the CodingGuidelines document.\n - A test helper \"test_seq\" function learned the \"-f