Every CVE Search/ Get API key

CVE-2026-40489

editorconfig-core-c has incomplete fix for CVE-2023-0341

8.6 HighPublic exploitFix available

CVE-2026-40489 is a high vulnerability (CVSS 8.6) in Editorconfig Editorconfig-core-c, published April 18, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 4th percentile. Fixed in editorconfig 0.12.11-r0.

editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allows an attacker to crash any application using libeditorconfig by providing a specially crafted directory structure and .editorconfig file. This is an incomplete fix for CVE-2023-0341. The pcre_str buffer was protected in 0.12.6 but the adjacent l_pattern[8194] stack buffer received no equivalent protection. On Ubuntu 24.04, FORTIFY_SOURCE converts the overflow to SIGABRT (DoS). Version 0.12.11 contains an updated fix.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.15%Up 0.1 points since Apr 18, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.6

editorconfig-core-c has incomplete fix for CVE-2023-0341

editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allows an attacker to crash any application using libeditorconfig by providing a specially crafted directory structure and .editorconfig file. This is an incomplete fix for CVE-2023-0341. The pcre_str buffer was protected in 0.12.6 but the adjacent l_pattern[8194] stack buffer received no equivalent protection. On Ubuntu 24.04, FORTIFY_SOURCE converts the overflow to SIGABRT (DoS). Version 0.12.11 contains an updated fix.

Record
CVE-2026-40489
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-121, CWE-787
Updated
2026-11-02
EUVDEUVD-2026-23636 8.6

editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allows an attacker to crash any application using libeditorconfig by providing a specially crafted directory structure and .editorconfig file. This is an incomplete fix for CVE-2023-0341. The pcre_str buffer was protected in 0.12.6 but the adjacent l_pattern[8194] stack buffer received no equivalent protection. On Ubuntu 24.04, FORTIFY_SOURCE converts the overflow to SIGABRT (DoS). Version 0.12.11 contains an updated fix.

Record
EUVD-2026-23636
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
NVD 8.6

editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allows an attacker to crash any application using libeditorconfig by providing a specially crafted directory structure and .editorconfig file. This is an incomplete fix for CVE-2023-0341. The pcre_str buffer was protected in 0.12.6 but the adjacent l_pattern[8194] stack buffer received no equivalent protection. On Ubuntu 24.04, FORTIFY_SOURCE converts the overflow to SIGABRT (DoS). Version 0.12.11 contains an updated fix.

Record
CVE-2026-40489
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-121, CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2026-40489 8.6

editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allows an attacker to crash any application using libeditorconfig by providing a specially crafted directory structure and .editorconfig file. This is an incomplete fix for CVE-2023-0341. The pcre_str buffer was protected in 0.12.6 but the adjacent l_pattern[8194] stack buffer received no equivalent protection. On Ubuntu 24.04, FORTIFY_SOURCE converts the overflow to SIGABRT (DoS). Version 0.12.11 contains an updated fix.

Record
ALPINE-CVE-2026-40489
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-03
OSV 8.6

editorconfig-core-c has incomplete fix for CVE-2023-0341

editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allows an attacker to crash any application using libeditorconfig by providing a specially crafted directory structure and .editorconfig file. This is an incomplete fix for CVE-2023-0341. The pcre_str buffer was protected in 0.12.6 but the adjacent l_pattern[8194] stack buffer received no equivalent protection. On Ubuntu 24.04, FORTIFY_SOURCE converts the overflow to SIGABRT (DoS). Version 0.12.11 contains an updated fix.

Record
CVE-2026-40489
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-121, CWE-787
Updated
2026-11-02
OSVDEBIAN-CVE-2026-40489 8.6

editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allows an attacker to crash any application using libeditorconfig by providing a specially crafted directory structure and .editorconfig file. This is an incomplete fix for CVE-2023-0341. The pcre_str buffer was protected in 0.12.6 but the adjacent l_pattern[8194] stack buffer received no equivalent protection. On Ubuntu 24.04, FORTIFY_SOURCE converts the overflow to SIGABRT (DoS). Version 0.12.11 contains an updated fix.

Record
DEBIAN-CVE-2026-40489
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 10 moreShow less
OSVOESA-2026-2258 8.6

editorconfig security update

EditorConfig makes it easy to maintain the correct coding style when switching between different text editors and between different projects. The EditorConfig project maintains a file format and plugins for various text editors which allow this file format to be read and used by those editors.

Security Fix(es):

editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allows an attacker to crash any application using libeditorconfig by providing a specially crafted directory structure and .editorconfig file. This is an incomplete fix for CVE-2023-0341. The pcre_str buffer was protected in 0.12.6 but the adjacent l_pattern[8194] stack buffer received no equivalent protection. On Ubuntu 24.04, FORTIFY_SOURCE converts the overflow to SIGABRT (DoS). Version 0.12.11 contains an updated fix.(CVE-2026-40489)

Record
OESA-2026-2258
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVOESA-2026-2259 8.6

editorconfig security update

EditorConfig makes it easy to maintain the correct coding style when switching between different text editors and between different projects. The EditorConfig project maintains a file format and plugins for various text editors which allow this file format to be read and used by those editors.

Security Fix(es):

editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allows an attacker to crash any application using libeditorconfig by providing a specially crafted directory structure and .editorconfig file. This is an incomplete fix for CVE-2023-0341. The pcre_str buffer was protected in 0.12.6 but the adjacent l_pattern[8194] stack buffer received no equivalent protection. On Ubuntu 24.04, FORTIFY_SOURCE converts the overflow to SIGABRT (DoS). Version 0.12.11 contains an updated fix.(CVE-2026-40489)

Record
OESA-2026-2259
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVOESA-2026-2260 8.6

editorconfig security update

EditorConfig makes it easy to maintain the correct coding style when switching between different text editors and between different projects. The EditorConfig project maintains a file format and plugins for various text editors which allow this file format to be read and used by those editors.

Security Fix(es):

editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allows an attacker to crash any application using libeditorconfig by providing a specially crafted directory structure and .editorconfig file. This is an incomplete fix for CVE-2023-0341. The pcre_str buffer was protected in 0.12.6 but the adjacent l_pattern[8194] stack buffer received no equivalent protection. On Ubuntu 24.04, FORTIFY_SOURCE converts the overflow to SIGABRT (DoS). Version 0.12.11 contains an updated fix.(CVE-2026-40489)

Record
OESA-2026-2260
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-40489 8.6

editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allows an attacker to crash any application using libeditorconfig by providing a specially crafted directory structure and .editorconfig file. This is an incomplete fix for CVE-2023-0341. The pcre_str buffer was protected in 0.12.6 but the adjacent l_pattern[8194] stack buffer received no equivalent protection. On Ubuntu 24.04, FORTIFY_SOURCE converts the overflow to SIGABRT (DoS). Version 0.12.11 contains an updated fix.

Record
UBUNTU-CVE-2026-40489
CVSS 4.0
8.6 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVopenSUSE-SU-2026:10663-1 No score

editorconfig-0.12.11-1.1 on GA media

These are all security issues fixed in the editorconfig-0.12.11-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10663-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20966-1 No score

Security update for editorconfig-core-c

This update for editorconfig-core-c fixes the following issue:

  • CVE-2026-40489: l_pattern buffer overflow (bsc#1262131).
Record
openSUSE-SU-2026:20966-1
Updated
2026-11-02
OSVSUSE-SU-2026:22125-1 No score

Security update for editorconfig-core-c

This update for editorconfig-core-c fixes the following issue:

  • CVE-2026-40489: l_pattern buffer overflow (bsc#1262131).
Record
SUSE-SU-2026:22125-1
Updated
2026-11-02
OSVSUSE-SU-2026:2731-1 No score

Security update for editorconfig-core-c

This update for editorconfig-core-c fixes the following issue:

  • CVE-2026-40489: improper use of strcpy can lead to a stack buffer overflow (bsc#1262131).
Record
SUSE-SU-2026:2731-1
Updated
2026-11-02
OSVUSN-8238-1 No score

editorconfig-core vulnerability

It was discovered that EditorConfig incorrectly handled specially crafted configuration files. A local attacker could possibly use this issue to cause EditorConfig to crash, resulting in a denial of service.

Record
USN-8238-1
Updated
2026-11-02
OSVUSN-8238-2 No score

editorconfig-core vulnerability

USN-8238-1 fixed a vulnerability in EditorConfig. This update contains the corresponding fix for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.

Original advisory details:

It was discovered that EditorConfig incorrectly handled specially crafted configuration files. A local attacker could possibly use this issue to cause EditorConfig to crash, resulting in a denial of service.

Record
USN-8238-2
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
editorconfig
Alpine:v3.24
 before 0.12.11-r0
0.12.11-r0
editorconfig-core
Debian:12
 All versions, plus listed versions
0.12.10+~0.17.1-10.12.10+~0.17.1-20.12.10+~0.17.1-30.12.6-0.10.12.7-0.10.12.9+~0.15.1-10.12.9+~0.17.1-10.12.9+~0.17.1-2
 None known
editorconfig-core
Debian:13
 All versions, plus listed versions
0.12.10+~0.17.1-10.12.10+~0.17.1-20.12.10+~0.17.1-30.12.9+~0.17.1-10.12.9+~0.17.1-2
 None known
editorconfig-core
Debian:14
 All versions, plus listed versions
0.12.10+~0.17.1-10.12.10+~0.17.1-20.12.10+~0.17.1-30.12.9+~0.17.1-10.12.9+~0.17.1-2
 None known
editorconfig
openEuler:24.03-LTS-SP3
 before 0.12.6-3.oe2403sp3
0.12.6-3.oe2403sp3
editorconfig
openEuler:24.03-LTS
 before 0.12.6-3.oe2403
0.12.6-3.oe2403
editorconfig
openEuler:24.03-LTS-SP1
 before 0.12.6-3.oe2403sp1
0.12.6-3.oe2403sp1
editorconfig-core-c
SUSE:Linux Enterprise Server 16.0
 before 0.12.9-160000.3.1
0.12.9-160000.3.1
editorconfig-core-c
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 0.12.9-160000.3.1
0.12.9-160000.3.1
editorconfig-core-c
SUSE:Linux Enterprise Module for Development Tools 15 SP7
 before 0.12.6-150600.3.6.1
0.12.6-150600.3.6.1
Show 9 moreShow less
Affected packages
PackageAffectedFixed
editorconfig-core
Ubuntu:Pro:16.04:LTS
 before 0.12.0-2ubuntu0.1~esm3, plus listed versions
0.12.0-20.12.0-2ubuntu0.1~esm10.12.0-2ubuntu0.1~esm2
0.12.0-2ubuntu0.1~esm3
editorconfig-core
Ubuntu:Pro:18.04:LTS
 before 0.12.1-1.1ubuntu0.18.04.1~esm3, plus listed versions
0.12.1-10.12.1-1.10.12.1-1.1ubuntu0.18.04.1~esm10.12.1-1.1ubuntu0.18.04.1~esm2
0.12.1-1.1ubuntu0.18.04.1~esm3
editorconfig-core
Ubuntu:Pro:20.04:LTS
 before 0.12.1-1.1+deb11u1ubuntu0.1~esm1, plus listed versions
0.12.1-1.10.12.1-1.1ubuntu0.20.04.1~esm10.12.1-1.1+deb11u1build0.20.04.1
0.12.1-1.1+deb11u1ubuntu0.1~esm1
editorconfig-core
Ubuntu:Pro:22.04:LTS
 before 0.12.5-2ubuntu0.1~esm3, plus listed versions
0.12.1-1.10.12.1-20.12.5-20.12.5-2ubuntu0.1~esm10.12.5-2ubuntu0.1~esm2
0.12.5-2ubuntu0.1~esm3
editorconfig-core
Ubuntu:24.04:LTS
 before 0.12.7-0.1ubuntu0.1, plus listed versions
0.12.6-0.10.12.7-0.1
0.12.7-0.1ubuntu0.1
editorconfig-core
Ubuntu:25.10
 before 0.12.9+~0.17.1-1ubuntu2.1, plus listed versions
0.12.9+~0.15.1-1ubuntu10.12.9+~0.17.1-10.12.9+~0.17.1-1ubuntu2
0.12.9+~0.17.1-1ubuntu2.1
editorconfig-core
Ubuntu:26.04:LTS
 before 0.12.10+~0.17.1-3ubuntu0.1, plus listed versions
0.12.9+~0.17.1-1ubuntu20.12.10+~0.17.1-20.12.10+~0.17.1-3
0.12.10+~0.17.1-3ubuntu0.1
editorconfig-core-c
openSUSE:Tumbleweed
 before 0.12.11-1.1
0.12.11-1.1
editorconfig-core-c
openSUSE:Leap 16.0
 before 0.12.9-160000.3.1
0.12.9-160000.3.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubsaretawa/CVE-2026-404892026-10-30

History

History
WhenChangedSources
2026-11-03affected, aliases, referencesOSV
2026-11-02createdCVE List, EUVD, NVD, OSV, PoC in GitHub

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open