CVE-2026-62960

Name of the Vulnerable Software and Affected Versions Git for Windows versions prior to 2.55.0.windows.4

Description A malicious remote Git server can advertise a bundle URI that is processed by the transport get remote bundle uri(), fetch bundle uri internal(), and copy uri to file() functions in bundle-uri.c during clone or fetch operations when transfer.bundleuri is set to true. Because non-HTTP(S) values are treated as local filesystem paths and file URI prefixes are removed, a bare UNC path or file URI targeting an attacker-controlled share triggers Windows to initiate an outbound SMB (Server Message Block) connection. This process can expose NTLM (New Technology LAN Manager) authentication material to the attacker-selected host.

Recommendations Update to version 2.55.0.windows.4. As a temporary mitigation, set transfer.bundleuri to false to prevent the processing of bundle URIs.