CVE-2026-40489: editorconfig-core-c has incomplete fix for CVE-2023-0341

Published Apr 18, 2026
·
Updated

editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ecglob() that allows an attacker to crash any application using libeditorconfig by providing a specially crafted directory structure and .editorconfig file. This is an incomplete fix for CVE-2023-0341. The pcrestr buffer was protected in 0.12.6 but the adjacent lpattern[8194] stack buffer received no equivalent protection. On Ubuntu 24.04, FORTIFYSOURCE converts the overflow to SIGABRT (DoS). Version 0.12.11 contains an updated fix.

Affected Software

2 affected components
editorconfig-core-c editorconfig-core-c<=0.12.10
debian/editorconfig-core<=0.12.1-1.1, <=0.12.1-1.1+deb11u1, <=0.12.6-0.1, <=0.12.9+~0.17.1-1, <=0.12.10+~0.17.1-3

Event History

Apr 18, 2026
CVE Published
via MITRE·01:24 AM
Data Sourced
via MITRE·01:24 AM
DescriptionWeakness
Data Sourced
via NVD·02:16 AM
DescriptionSeverityWeakness
Jun 4, 2026
Data Sourced
via Debian·05:40 PM
DescriptionAffected Software
Data Sourced
via Launchpad·05:40 PM
Description
Jun 6, 2026
Data Sourced
via Ubuntu·05:41 PM
RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2026-40489?

CVE-2026-40489 is classified as a critical vulnerability due to its potential to cause stack-based buffer overflow and application crashes.

2

How do I fix CVE-2026-40489?

To fix CVE-2026-40489, upgrade the editorconfig-core-c library to version 0.12.11 or later.

3

What software versions are affected by CVE-2026-40489?

CVE-2026-40489 affects versions of editorconfig-core-c up to and including 0.12.10.

4

What are the risks associated with CVE-2026-40489?

The risks associated with CVE-2026-40489 include application crashes and potential denial of service for affected applications.

5

Is CVE-2026-40489 related to any previous vulnerabilities?

Yes, CVE-2026-40489 is an incomplete fix for CVE-2023-0341, indicating a failure to fully address the previous vulnerability.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203