CVE-2026-32631
Severity CVSS v4.0:
Pending analysis
Type:
CWE-200
Information Leak / Disclosure
Publication date:
15/04/2026
Last modified:
15/04/2026
Description
Git for Windows is the Windows port of Git. Versions prior to 2.53.0.windows.3 do not have protections that prevent attackers from obtaining a user's NTLM hash. The NTLM hash can be obtained by tricking users into cloning a malicious repository, or checking out a malicious branch, that accesses an attacker-controlled server. By default, NTLM authentication does not need any user interaction. By brute-forcing the NTLMv2 hash (which is expensive, but possible), credentials can be extracted. This issue has been fixed in version 2.53.0.windows.3.
Impact
Base Score 3.x
7.40
Severity 3.x
HIGH
References to Advisories, Solutions, and Tools
- https://github.com/git-for-windows/git/releases/tag/v2.53.0.windows.3
- https://github.com/git-for-windows/git/security/advisories/GHSA-9j5h-h4m7-85hx
- https://learn.microsoft.com/en-au/windows/whats-new/deprecated-features#:~:text=NTLM
- https://support.microsoft.com/en-us/topic/upcoming-changes-to-ntlmv1-in-windows-11-version-24h2-and-windows-server-2025-c0554217-cdbc-420f-b47c-e02b2db49b2e
- https://techcommunity.microsoft.com/blog/windows-itpro-blog/the-evolution-of-windows-authentication/3926848