CVE-2026-105437

Affected versions of Git are vulnerable to a heap-based buffer overflow in the three-way merge code (xdiff ). The issue stems from using a 32-bit signed integer to calculate merged output size; a large conflict-marker-size in a .gitattributes file can cause an integer wrap-around, leading Git to ...

EUVD-2026-122614

Affected versions of Git have a heap buffer overflow in the three-way merge code xdiff, which an attacker can trigger through a repository they control. When Git merges a file, it first adds up the size of the merged output, allocates a buffer of that size, and then writes the output into it. Tha...