editorconfig editorconfig-core-c up to 0.12.10 EditorConfig Parser ec_glob stack-based overflow

Summaryinfo

A vulnerability was found in editorconfig editorconfig-core-c up to 0.12.10. It has been rated as critical. Affected by this issue is the function ec_glob of the component EditorConfig Parser. This manipulation causes stack-based overflow. This vulnerability appears as CVE-2026-40489. The attack requires local access. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical was found in editorconfig editorconfig-core-c up to 0.12.10. Affected by this vulnerability is the function ec_glob of the component EditorConfig Parser. The manipulation with an unknown input leads to a stack-based overflow vulnerability. The CWE definition for the vulnerability is CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allows an attacker to crash any application using libeditorconfig by providing a specially crafted directory structure and .editorconfig file. This is an incomplete fix for CVE-2023-0341. The pcre_str buffer was protected in 0.12.6 but the adjacent l_pattern[8194] stack buffer received no equivalent protection. On Ubuntu 24.04, FORTIFY_SOURCE converts the overflow to SIGABRT (DoS). Version 0.12.11 contains an updated fix.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-40489 since 04/13/2026. The exploitation appears to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 307457 (Linux Distros Unpatched Vulnerability : CVE-2026-40489), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.12.11 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 5159be88ad50641d9843289adda791ba300421ff is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (307457) and EUVD (EUVD-2026-23636). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• editorconfig

Name

• editorconfig-core-c

Version

• 0.12.0
• 0.12.1
• 0.12.2
• 0.12.3
• 0.12.4
• 0.12.5
• 0.12.6
• 0.12.7
• 0.12.8
• 0.12.9
• 0.12.10

License

• open-source

Website

• Product: https://github.com/editorconfig/editorconfig-core-c/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion