Command substitution ($()) causes 0xc0000005 access violation in Git 2.53.0 on Parallels VM

[mrlerch]

Setup

• Git version: 2.53.0 (MSYS2 runtime 3.6.6, dated 2026-01-15)
• OS: Windows 11 Pro (Build 26200) running in Parallels Desktop VM on macOS
• Architecture: x86_64
• Working version: Git 2.47.1 (MSYS2 runtime 3.5.4) — no issues

Bug

Bash command substitution ($() and backticks) causes an access violation (exit code 0xc0000005) in Git for Windows 2.53.0. This makes Git Bash completely unusable as the profile.d startup scripts rely on command substitution.

Reproduction

From PowerShell, using a clean shell with no profile scripts:

# This works (no command substitution):
& "C:\Program Files\Git\bin\bash.exe" --norc --noprofile -c "echo hello"
# Output: hello

# This works (subshell, no output capture):
& "C:\Program Files\Git\bin\bash.exe" --norc --noprofile -c "( echo hello )"
# Output: hello

# This works (pipe):
& "C:\Program Files\Git\bin\bash.exe" --norc --noprofile -c "echo hello | cat"
# Output: hello

# THIS CRASHES (command substitution):
& "C:\Program Files\Git\bin\bash.exe" --norc --noprofile -c 'result=$(echo hello); echo $result'
# No output, process exits with 0xc0000005

# Backticks also crash:
& "C:\Program Files\Git\bin\bash.exe" --norc --noprofile -c 'result=`echo hello`; echo $result'
# No output, process exits with 0xc0000005

Impact

This breaks Git Bash startup entirely because /etc/profile and multiple /etc/profile.d/*.sh scripts use command substitution:

• aliases.sh — $(type -p "$name".exe) in the winpty alias loop
• git-prompt.sh — $(git --exec-path) for completion setup
• lang.sh — $(/usr/bin/locale -uU) for locale detection
• /etc/profile — $(exec /usr/bin/hostname) and others

Launching Git Bash normally (mintty) immediately crashes with:

[process exited with code 3221225477 (0xc0000005)]

Analysis

The crash occurs specifically when bash performs output capture from a forked child process — the mechanism shared by $() and backticks. Regular subshells ( ) and pipes | (which also fork) work fine, indicating the issue is in the fork+pipe-back-to-parent code path in the MSYS2 runtime, not fork() itself.

Workaround

Downgrade to Git 2.47.1 (MSYS2 runtime 3.5.4):

winget uninstall "ARP\Machine\X64\Git_is1"
winget install Git.Git --version 2.47.1

Environment Notes

• Running in a Parallels Desktop VM with nested virtualization enabled
• Malwarebytes installed (bash.exe was excluded — did not resolve the issue)
• Windows Exploit Protection mitigations all NOTSET for bash.exe
• No third-party DLLs injected into bash process (verified via /proc/self/maps)
• Fresh install of Git 2.53.0 exhibited the same behavior — not a corrupted installation

[dscho]

• Malwarebytes installed (bash.exe was excluded — did not resolve the issue)

Given previous woes with Malwarebytes, I don't trust that exclusion to work as intended one bit. My money is on Malwarebytes causing that access violation.