CVE-2025-66413: Gitforwindows Git

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Git for Windows is the Windows port of Git. Prior to 2.53.0(2), it is possible to obtain a user's NTLM hash by tricking them into cloning from a malicious server. Since NTLM hashing is weak, it is possible for the attacker to brute-force the user's account name and password. This vulnerability is fixed in 2.53.0(2).

Affected products

• Gitforwindows Git: up to and including 2.53.0

Published 2026-03-10. Last modified 2026-06-17.