CVE-2025-66413 identifies a vulnerability in Git for Windows versions prior to 2.53.0(2) that enables NTLM hash theft. An attacker can exploit this by deceiving a user into cloning from a malicious server, allowing for subsequent brute-forcing of user account credentials due to the inherent weakness of NTLM hashing. This vulnerability carries a CVSS score of 7.4 (HIGH), indicating a significant confidentiality risk that requires user interaction but can be executed remotely with low attack complexity. While there are no known public exploits or evidence of active exploitation in the wild, the CVE is listed on a "Hot List" and has garnered limited community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.53.0CPE matchmatch criteria | cpe:2.3:a:gitforwindows:git:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.