{"id":"CVE-2024-53849","aliases":["DEBIAN-CVE-2024-53849","DLA-3978-1","EUVD-2024-52173","GHSA-475j-wc37-6274","SUSE-SU-2024:4152-1","UBUNTU-CVE-2024-53849","USN-7168-1"],"status":"published","title":"Several stack buffer overflows and pointer overflows in editorconfig-core-c","description":"editorconfig-core-c  is  theEditorConfig core library written in C (for use by plugins supporting EditorConfig parsing). In affected versions several overflows may occur in switch case '[' when the input pattern contains many escaped characters. The added backslashes leave too little space in the output pattern when processing nested brackets such that the remaining input length exceeds the output capacity. This issue has been addressed in release version 0.12.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.","severity":{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00204,"percentile":0.10494,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121"],"published":"2024-11-26T23:34:58Z","modified":"2026-11-02T12:02:58Z","fixes":[{"ecosystem":"Debian:13","package":"editorconfig-core","fixed_in":["0.12.7-0.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"editorconfig-core","fixed_in":["0.12.7-0.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"editorconfig-core-c","fixed_in":["0.12.6-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"editorconfig-core-c","fixed_in":["0.12.6-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"editorconfig-core","fixed_in":["0.12.0-2ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"editorconfig-core","fixed_in":["0.12.1-1.1ubuntu0.18.04.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"editorconfig-core","fixed_in":["0.12.1-1.1+deb11u1build0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"editorconfig-core","fixed_in":["0.12.5-2ubuntu0.1~esm2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.10+~0.17.1-1","0.12.10+~0.17.1-2","0.12.10+~0.17.1-3","0.12.6-0.1","0.12.7-0.1","0.12.9+~0.15.1-1","0.12.9+~0.17.1-1","0.12.9+~0.17.1-2"]},{"source":"osv","ecosystem":"Debian:13","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.7-0.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.7-0.1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.1-1.1+deb11u1"}]}],"versions":["0.12.1-1.1"],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"editorconfig-core-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.6-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"editorconfig-core-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.6-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-2ubuntu0.1~esm2"}]}],"versions":["0.12.0-2","0.12.0-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.1-1.1ubuntu0.18.04.1~esm2"}]}],"versions":["0.12.1-1","0.12.1-1.1","0.12.1-1.1ubuntu0.18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.1-1.1+deb11u1build0.20.04.1"}]}],"versions":["0.12.1-1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5-2ubuntu0.1~esm2"}]}],"versions":["0.12.1-1.1","0.12.1-2","0.12.5-2","0.12.5-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-2ubuntu0.1~esm2"}]}],"versions":["0.12.0-2","0.12.0-2ubuntu0.1~esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.1-1.1ubuntu0.18.04.1~esm2"}]}],"versions":["0.12.1-1","0.12.1-1.1","0.12.1-1.1ubuntu0.18.04.1~esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.1-1.1+deb11u1build0.20.04.1"}]}],"versions":["0.12.1-1.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"editorconfig-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.5-2ubuntu0.1~esm2"}]}],"versions":["0.12.1-1.1","0.12.1-2","0.12.5-2","0.12.5-2ubuntu0.1~esm1"],"bundled":2}],"products":[{"vendor":"editorconfig","product":"editorconfig"},{"vendor":"editorconfig","product":"editorconfig-core-c"}],"references":[{"url":"https://github.com/editorconfig/editorconfig-core-c/security/advisories/GHSA-475j-wc37-6274","tags":["x_refsource_CONFIRM","advisory","report"]},{"url":"https://github.com/editorconfig/editorconfig-core-c/pull/103","tags":["x_refsource_MISC","fix","report"]},{"url":"https://github.com/editorconfig/editorconfig-core-c/commit/4d5518a0a4e4910c37281ab13a048d0d86999782","tags":["x_refsource_MISC","fix","report"]},{"url":"https://github.com/editorconfig/editorconfig-core-c/commit/a8dd5312e08abeab95ff5656d32ed3cb85fba70b","tags":["x_refsource_MISC","fix","report"]},{"url":"http://editorconfig.org","tags":["x_refsource_MISC","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/11/msg00036.html","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53849.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53849","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-53849","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244152-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1233815","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53849","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-53849","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-53849","tags":["report"]},{"url":"https://github.com/editorconfig/editorconfig-core-c/commit/fca7cf19e0fb800c2d38f173c1f69ad40bf2a2f5","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7168-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-0341","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-53849","title":"Several stack buffer overflows and pointer overflows in editorconfig-core-c","description":"editorconfig-core-c  is  theEditorConfig core library written in C (for use by plugins supporting EditorConfig parsing). In affected versions several overflows may occur in switch case '[' when the input pattern contains many escaped characters. The added backslashes leave too little space in the output pattern when processing nested brackets such that the remaining input length exceeds the output capacity. This issue has been addressed in release version 0.12.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-11-26T23:34:58.784Z","modified":"2025-11-03T22:29:45.195Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:34:17.523201Z"}],"euvd":[{"id":"EUVD-2024-52173","description":"editorconfig-core-c  is  theEditorConfig core library written in C (for use by plugins supporting EditorConfig parsing). In affected versions several overflows may occur in switch case '[' when the input pattern contains many escaped characters. The added backslashes leave too little space in the output pattern when processing nested brackets such that the remaining input length exceeds the output capacity. This issue has been addressed in release version 0.12.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-11-26T23:34:58Z","modified":"2025-11-03T22:29:45Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:49:29.890052Z"}],"nvd":[{"id":"CVE-2024-53849","description":"editorconfig-core-c  is  theEditorConfig core library written in C (for use by plugins supporting EditorConfig parsing). In affected versions several overflows may occur in switch case '[' when the input pattern contains many escaped characters. The added backslashes leave too little space in the output pattern when processing nested brackets such that the remaining input length exceeds the output capacity. This issue has been addressed in release version 0.12.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-11-27T00:15:18.223Z","modified":"2026-06-17T08:09:24.9Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:10:38.347238Z"}],"osv":[{"id":"CVE-2024-53849","title":"Several stack buffer overflows and pointer overflows in editorconfig-core-c","description":"editorconfig-core-c  is  theEditorConfig core library written in C (for use by plugins supporting EditorConfig parsing). In affected versions several overflows may occur in switch case '[' when the input pattern contains many escaped characters. The added backslashes leave too little space in the output pattern when processing nested brackets such that the remaining input length exceeds the output capacity. This issue has been addressed in release version 0.12.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-11-26T23:34:58.784Z","modified":"2026-11-11T02:47:37.969276961Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-121"],"updated_at":"2026-11-11T03:22:28.447808Z"},{"id":"DEBIAN-CVE-2024-53849","description":"editorconfig-core-c  is  theEditorConfig core library written in C (for use by plugins supporting EditorConfig parsing). In affected versions several overflows may occur in switch case '[' when the input pattern contains many escaped characters. The added backslashes leave too little space in the output pattern when processing nested brackets such that the remaining input length exceeds the output capacity. This issue has been addressed in release version 0.12.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-11-27T00:15:18.223Z","modified":"2026-11-02T12:02:58.551598705Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:44.117337Z"},{"id":"UBUNTU-CVE-2024-53849","description":"editorconfig-core-c  is  theEditorConfig core library written in C (for use by plugins supporting EditorConfig parsing). In affected versions several overflows may occur in switch case '[' when the input pattern contains many escaped characters. The added backslashes leave too little space in the output pattern when processing nested brackets such that the remaining input length exceeds the output capacity. This issue has been addressed in release version 0.12.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-11-27T00:15:00Z","modified":"2026-04-22T15:20:26.861321Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:11.182485Z"},{"id":"DLA-3978-1","title":"editorconfig-core - security update","status":"published","published":"2024-11-30T00:00:00Z","modified":"2026-03-09T01:20:41.108921Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"SUSE-SU-2024:4152-1","title":"Security update for editorconfig-core-c","description":"This update for editorconfig-core-c fixes the following issues:\n\n- CVE-2024-53849: stack buffer overflow and pointer overflow when handling escaped characters. (bsc#1233815)\n","status":"published","published":"2024-12-03T11:10:51Z","modified":"2026-02-04T04:30:05.15149Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"USN-7168-1","title":"editorconfig-core vulnerabilities","description":"It was discovered that EditorConfig improperly managed memory when handling\ncertain inputs, leading to overflows. An attacker could possibly use these\nissues to cause a denial of service, or execute arbitrary code.\n","status":"published","published":"2024-12-18T09:48:05Z","modified":"2026-06-25T13:32:29.855153024Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}