CVE-2026-114467 PUBLISHED

Out-of-bounds Write in Git

Assigner: GitLab
Reserved: 21.10.2026 Published: 12.11.2026 Updated: 12.11.2026

Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS Score: 3.3

Product Status

Vendor Git
Product Git
Versions Default: unknown
  • Version 2.50.1 is affected
  • Version 2.51.2 is affected
  • Version 2.52.0 is affected
  • Version 2.53.0 is affected
  • Version 2.54.0 is affected
  • Version 2.55.0 is affected
  • Version 2.56.0 is affected

Solutions

Upgrade to versions 2.50.2, 2.51.3, 2.52.1, 2.53.1, 2.54.1, 2.55.1, 2.56.1 or above.

Credits

  • ehdgks0627, un3xploitable finder

References

Problem Types

  • CWE-787: Out-of-bounds Write CWE