“The parser used to read these files has multiple integer overflows, which can occur when parsing either a large number of patterns, a large number of attributes, or attributes with overly-long names.”
A malicious .gitattributes file or a git log --format padding operator can trigger arbitrary heap reads and writes in every Git up to 2.39. Both bugs turned up in an audit by X41, paid for by OSTIF. GitHub, GitLab and everyone else built businesses on Git, and an outside fund had to sponsor the security review. The Windows bonus bug runs code from the current directory when you clone with Git GUI.