CVE-2026-40489: editorconfig-core-c has incomplete fix for CVE-2023-0341
editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ecglob() that allows an attacker to crash any application using libeditorconfig by providing a specially crafted directory structure and .editorconfig file. This is an incomplete fix for CVE-2023-0341. The pcrestr buffer was protected in 0.12.6 but the adjacent lpattern[8194] stack buffer received no equivalent protection. On Ubuntu 24.04, FORTIFYSOURCE converts the overflow to SIGABRT (DoS). Version 0.12.11 contains an updated fix.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40489?
CVE-2026-40489 is classified as a critical vulnerability due to its potential to cause stack-based buffer overflow and application crashes.
How do I fix CVE-2026-40489?
To fix CVE-2026-40489, upgrade the editorconfig-core-c library to version 0.12.11 or later.
What software versions are affected by CVE-2026-40489?
CVE-2026-40489 affects versions of editorconfig-core-c up to and including 0.12.10.
What are the risks associated with CVE-2026-40489?
The risks associated with CVE-2026-40489 include application crashes and potential denial of service for affected applications.
Is CVE-2026-40489 related to any previous vulnerabilities?
Yes, CVE-2026-40489 is an incomplete fix for CVE-2023-0341, indicating a failure to fully address the previous vulnerability.