CVE-2026-105437

Affected versions of Git have a heap buffer overflow in the three-way merge code xdiff, which an attacker can trigger through a repository they control. When Git merges a file, it first adds up the size of the merged output, allocates a buffer of that size, and then writes the output into it. Tha...