Impact

The wincred credential helper uses a static buffer (target) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with wcsncat(), leading to potential buffer overflows.

Workarounds

Upgrade to the latest Git version(s), or avoid using the wincred helper in the meantime if upgrading is not possible.