GitHub: CVE-2025-48386 Git Credential Helper Vulnerability
🔗 CVE IDs covered (1)
📋 Description
CVE-2025-48386 is regarding a vulnerability in Git where the wincred credential helper uses a static buffer (target) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with wcsncat(), leading to potential buffer overflows. GitHub created this CVE on their behalf. The documented Visual Studio updates incorporate updates in Git which address this vulnerability. Please see CVE-2025-48386 for more information.
🎯 Affected products6
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
- Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
- Microsoft Visual Studio 2022 version 17.10
- Microsoft Visual Studio 2022 version 17.12
- Microsoft Visual Studio 2022 version 17.14
- Microsoft Visual Studio 2022 version 17.8
✅ Remediation
KBRelease Notes (Security Update) — fixed build 17.10.17 KBRelease Notes (Security Update) — fixed build 17.14.8 KBRelease Notes (Security Update) — fixed build 16.11.49 KBRelease Notes (Security Update) — fixed build 15.9.75 KBRelease Notes (Security Update) — fixed build 17.8.23 KBRelease Notes (Security Update) — fixed build 17.12.10
🔗 References (10)
- advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-48386
- patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.10
- referencehttps://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
- patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.14
- patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2019 version 16.11
- referencehttps://docs.microsoft.com/en-us/visualstudio/releases/2019/release-notes-v16.11
- patchhttp://aka.ms/vs/15/release/latest
- referencehttps://docs.microsoft.com/en-us/visualstudio/releasenotes/vs2017-relnotes
- patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.8
- patchhttps://my.visualstudio.com/Downloads?q=Visual Studio 2022 version 17.12