The project describes it as a security-fix release following Git for Windows 2.56.0(2), released on October 5, 2026.
The release says it addresses the eMudhra Intermediate CA compromise. It also updates the bundled Git LFS version to 3.8.1 to address CVE-2026-105803. The package additionally includes OpenSSH 10.6.P1 and cURL 8.23.0.
Release assets include installers for 64-bit and ARM64 Windows, portable builds, and MinGit archives, including 32-bit MinGit variants. The listed SHA-256 value for Git-2.56.0.3-64-bit.exe is dc6d3db061999136e139f31376c5582a9ed6f36a4ea12f15e54ad7fa2bfc0bf2. The release page is available at https://github.com/git-for-windows/git/releases/tag/v2.56.0.windows.3.
The release notes do not state whether CVE-2026-105803 was exploited in the wild, whether any Git for Windows users were affected, or the full operational impact of the certificate authority compromise. They also do not provide upgrade guidance beyond the published release assets.