CVE catalog

CVE-2026-40489

editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allow

[CVE catalog]

Severity
High · CVSS 8.6CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Source
[NVD] · [CVE record]
EPSS
0.15% · Oct 25, 2026

editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allows an attacker to crash any application using libeditorconfig by providing a specially crafted directory structure and .editorconfig file. This is an incomplete fix for CVE-2023-0341. The pcre_str buffer was protected in 0.12.6 but the adjacent l_pattern[8194] stack buffer received no equivalent protection. On Ubuntu 24.04, FORTIFY_SOURCE converts the overflow to SIGABRT (DoS). Version 0.12.11 contains an updated fix.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianeditorconfig-coresid0.12.10+~0.17.1-3vulnerable
Debianeditorconfig-coreforky0.12.10+~0.17.1-3vulnerable
Debianeditorconfig-coretrixie0.12.9+~0.17.1-1vulnerable
Debianeditorconfig-corebookworm0.12.6-0.1vulnerable
Cpeeditorconfig-coreNot reported0.12.7-0.1ubuntu0.1fixed
CpeeditorconfigNot reported0.12.7-0.1ubuntu0.1fixed
Cpeeditorconfig-docNot reported0.12.7-0.1ubuntu0.1fixed
Cpelibeditorconfig-devNot reported0.12.7-0.1ubuntu0.1fixed
Cpelibeditorconfig0Not reported0.12.7-0.1ubuntu0.1fixed
Cpeeditorconfig-coreNot reportedNot reportedvulnerable
Suseeditorconfig-core-clinux enterprise module for development tools 15 sp70.12.6-150600.3.6.1fixed
Opensuseeditorconfig-core-cleap 16.00.12.9-160000.3.1fixed
Suseeditorconfig-core-clinux enterprise server 16.00.12.9-160000.3.1fixed
Suseeditorconfig-core-clinux enterprise server for sap applications 16.00.12.9-160000.3.1fixed
Ubuntueditorconfig-corepro0.12.1-1.1vulnerable
Ubuntueditorconfig-corepro0.12.1-2vulnerable
Ubuntueditorconfig-corepro0.12.5-2vulnerable
Ubuntueditorconfig-corepro0.12.5-2ubuntu0.1~esm1vulnerable
Ubuntueditorconfig-corepro0.12.5-2ubuntu0.1~esm2vulnerable
Ubuntueditorconfig-corepro0.12.5-2ubuntu0.1~esm3fixed
Ubuntueditorconfig-corepro0.12.1-1.1vulnerable
Ubuntueditorconfig-corepro0.12.1-2vulnerable
Ubuntueditorconfig-corepro0.12.5-2vulnerable
Ubuntueditorconfig-corepro0.12.5-2ubuntu0.1~esm1vulnerable
Ubuntueditorconfig-corepro0.12.5-2ubuntu0.1~esm2vulnerable
Ubuntueditorconfig-corepro0.12.5-2ubuntu0.1~esm3fixed
Ubuntueditorconfig-core24.040.12.6-0.1vulnerable
Ubuntueditorconfig-core24.040.12.7-0.1vulnerable
Ubuntueditorconfig-core24.040.12.7-0.1ubuntu0.1fixed
Ubuntueditorconfig-core25.100.12.9+~0.15.1-1ubuntu1vulnerable
Ubuntueditorconfig-core25.100.12.9+~0.17.1-1vulnerable
Ubuntueditorconfig-core25.100.12.9+~0.17.1-1ubuntu2vulnerable
Ubuntueditorconfig-core25.100.12.9+~0.17.1-1ubuntu2.1fixed
Ubuntueditorconfig-core26.040.12.9+~0.17.1-1ubuntu2vulnerable
Ubuntueditorconfig-core26.040.12.10+~0.17.1-2vulnerable
Ubuntueditorconfig-core26.040.12.10+~0.17.1-3vulnerable
Ubuntueditorconfig-core26.040.12.10+~0.17.1-3ubuntu0.1fixed
Ubuntueditorconfig-core24.040.12.6-0.1vulnerable
Ubuntueditorconfig-core24.040.12.7-0.1vulnerable
Ubuntueditorconfig-core24.040.12.7-0.1ubuntu0.1fixed
Ubuntueditorconfig-core25.100.12.9+~0.15.1-1ubuntu1vulnerable
Ubuntueditorconfig-core25.100.12.9+~0.17.1-1vulnerable
Ubuntueditorconfig-core25.100.12.9+~0.17.1-1ubuntu2vulnerable
Ubuntueditorconfig-core25.100.12.9+~0.17.1-1ubuntu2.1fixed
Ubuntueditorconfig-core26.040.12.9+~0.17.1-1ubuntu2vulnerable
Ubuntueditorconfig-core26.040.12.10+~0.17.1-2vulnerable
Ubuntueditorconfig-core26.040.12.10+~0.17.1-3vulnerable
Ubuntueditorconfig-core26.040.12.10+~0.17.1-3ubuntu0.1fixed
Opensuseeditorconfig-core-ctumbleweed0.12.11-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianeditorconfig-coresourcesid(unfixed)not yet assignedNot reported[1134338]
Debianeditorconfig-coresourceforky(unfixed)not yet assignedNot reported[1134338]
Debianeditorconfig-coresourcetrixie(unfixed)not yet assignedNot reported[1134338]
Debianeditorconfig-coresourcebookworm(unfixed)not yet assignedNot reported[1134338]
Cpeeditorconfig-corecpeNot reported0.12.7-0.1ubuntu0.1Not reportedNot reportedNot reported
CpeeditorconfigcpeNot reported0.12.7-0.1ubuntu0.1Not reportedNot reportedNot reported
Cpeeditorconfig-doccpeNot reported0.12.7-0.1ubuntu0.1Not reportedNot reportedNot reported
Cpelibeditorconfig-devcpeNot reported0.12.7-0.1ubuntu0.1Not reportedNot reportedNot reported
Cpelibeditorconfig0cpeNot reported0.12.7-0.1ubuntu0.1Not reportedNot reportedNot reported
Suseeditorconfig-core-crpmlinux enterprise module for development tools 15 sp70.12.6-150600.3.6.1Not reportedSUSE-SU-2026:2731-1Not reported
Opensuseeditorconfig-core-crpmleap 16.00.12.9-160000.3.1Not reportedOPENSUSE-SU-2026:20966-1Not reported
Suseeditorconfig-core-crpmlinux enterprise server 16.00.12.9-160000.3.1Not reportedSUSE-SU-2026:22125-1Not reported
Suseeditorconfig-core-crpmlinux enterprise server for sap applications 16.00.12.9-160000.3.1Not reportedSUSE-SU-2026:22125-1Not reported
Ubuntueditorconfig-coredebpro0.12.5-2ubuntu0.1~esm3Not reportedUSN-8238-2Not reported
Ubuntueditorconfig-coredebpro0.12.5-2ubuntu0.1~esm3Not reportedUBUNTU-CVE-2026-40489Not reported
Ubuntueditorconfig-coredeb24.040.12.7-0.1ubuntu0.1Not reportedUBUNTU-CVE-2026-40489Not reported
Ubuntueditorconfig-coredeb25.100.12.9+~0.17.1-1ubuntu2.1Not reportedUBUNTU-CVE-2026-40489Not reported
Ubuntueditorconfig-coredeb26.040.12.10+~0.17.1-3ubuntu0.1Not reportedUBUNTU-CVE-2026-40489Not reported
Ubuntueditorconfig-coredeb24.040.12.7-0.1ubuntu0.1Not reportedUSN-8238-1Not reported
Ubuntueditorconfig-coredeb25.100.12.9+~0.17.1-1ubuntu2.1Not reportedUSN-8238-1Not reported
Ubuntueditorconfig-coredeb26.040.12.10+~0.17.1-3ubuntu0.1Not reportedUSN-8238-1Not reported
Opensuseeditorconfig-core-crpmtumbleweed0.12.11-1.1Not reportedOPENSUSE-SU-2026:10663-1Not reported

[Debian bug #1134338]

Notes

[trixie] editorconfig-core: Minor issue [bookworm] editorconfig-core: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [editorconfig]Affected

    Source package: [editorconfig-core]

    Details (2)

    • 0.12.6-0.1 · amd64 · bookworm

      Affected

      nvd · editorconfig-core · debian · bookworm; nvd · editorconfig-core · debian · 12

    • 0.12.6-0.1 · arm64 · bookworm

      Affected

      nvd · editorconfig-core · debian · bookworm; nvd · editorconfig-core · debian · 12

  • [editorconfig-doc]Affected

    Source package: [editorconfig-core]

    Details (2)

    • 0.12.6-0.1 · all · bookworm

      Affected

      nvd · editorconfig-core · debian · bookworm; nvd · editorconfig-core · debian · 12

    • 0.12.6-0.1 · all · bookworm

      Affected

      nvd · editorconfig-core · debian · bookworm; nvd · editorconfig-core · debian · 12

  • [libeditorconfig0]Affected

    Source package: [editorconfig-core]

    Details (2)

    • 0.12.6-0.1 · amd64 · bookworm

      Affected

      nvd · editorconfig-core · debian · bookworm; nvd · editorconfig-core · debian · 12

    • 0.12.6-0.1 · arm64 · bookworm

      Affected

      nvd · editorconfig-core · debian · bookworm; nvd · editorconfig-core · debian · 12

  • [libeditorconfig-dev]Affected

    Source package: [editorconfig-core]

    Details (2)

    • 0.12.6-0.1 · amd64 · bookworm

      Affected

      nvd · editorconfig-core · debian · bookworm; nvd · editorconfig-core · debian · 12

    • 0.12.6-0.1 · arm64 · bookworm

      Affected

      nvd · editorconfig-core · debian · bookworm; nvd · editorconfig-core · debian · 12

[Debian 13 (Trixie)]

  • [editorconfig]Affected

    Source package: [editorconfig-core]

    Details (2)

    • 0.12.9+~0.17.1-1 · amd64 · trixie

      Affected

      nvd · editorconfig-core · debian · 13

    • 0.12.9+~0.17.1-1 · arm64 · trixie

      Affected

      nvd · editorconfig-core · debian · 13

  • [editorconfig-doc]Affected

    Source package: [editorconfig-core]

    Details (2)

    • 0.12.9+~0.17.1-1 · all · trixie

      Affected

      nvd · editorconfig-core · debian · 13

    • 0.12.9+~0.17.1-1 · all · trixie

      Affected

      nvd · editorconfig-core · debian · 13

  • [libeditorconfig0]Affected

    Source package: [editorconfig-core]

    Details (2)

    • 0.12.9+~0.17.1-1 · amd64 · trixie

      Affected

      nvd · editorconfig-core · debian · 13

    • 0.12.9+~0.17.1-1 · arm64 · trixie

      Affected

      nvd · editorconfig-core · debian · 13

  • [libeditorconfig-dev]Affected

    Source package: [editorconfig-core]

    Details (2)

    • 0.12.9+~0.17.1-1 · amd64 · trixie

      Affected

      nvd · editorconfig-core · debian · 13

    • 0.12.9+~0.17.1-1 · arm64 · trixie

      Affected

      nvd · editorconfig-core · debian · 13

[openSUSE Tumbleweed]

  • [editorconfig]Unknown

    Source package: [editorconfig-core-c]

    Details (1)

    • 0.12.11-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 0.12.11-1.1

      Version impact unknown

      nvd · editorconfig-core-c · opensuse · tumbleweed

  • [libeditorconfig0]Unknown

    Source package: [editorconfig-core-c]

    Details (1)

    • 0.12.11-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 0.12.11-1.1

      Version impact unknown

      nvd · editorconfig-core-c · opensuse · tumbleweed

  • [libeditorconfig-devel]Unknown

    Source package: [editorconfig-core-c]

    Details (1)

    • 0.12.11-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 0.12.11-1.1

      Version impact unknown

      nvd · editorconfig-core-c · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]