CVE-2026-82605: BareBones BBEdit Lasso Language Tokenizer infinite loop

Q: Which BBEdit versions need to be remediated?

BareBones BBEdit versions up to and including 15.5.5 are affected. Upgrading to version 16.0 fixes the issue.

Q: Can this be exploited over the network without an account?

The issue is described as remotely executable, and the vector lists no privileges required. Exploitation also requires user interaction.

Q: What is the operational impact if exploitation succeeds?

Manipulation of the Lasso Language Tokenizer can cause an infinite loop, resulting in an availability impact. No confidentiality or integrity impact is identified in the supplied severity vector.

Published Aug 31, 2026

Updated

A vulnerability has been found in BareBones BBEdit up to 15.5.5. The affected element is an unknown function of the component Lasso Language Tokenizer. Such manipulation leads to infinite loop. The attack can be executed remotely. Upgrading to version 16.0 is sufficient to fix this issue. The affected component should be upgraded.

Affected Software

1 affected component

Barebones Bbedit<=15.5.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade BareBones BBEdit to a version that resolves this vulnerability.
Fixed in 16.0

Event History

Aug 31, 2026

CVE Published

via MITRE·02:15 AM

Data Sourced

via MITRE·02:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which BBEdit versions need to be remediated?

BareBones BBEdit versions up to and including 15.5.5 are affected. Upgrading to version 16.0 fixes the issue.

Can this be exploited over the network without an account?

The issue is described as remotely executable, and the vector lists no privileges required. Exploitation also requires user interaction.

What is the operational impact if exploitation succeeds?

Manipulation of the Lasso Language Tokenizer can cause an infinite loop, resulting in an availability impact. No confidentiality or integrity impact is identified in the supplied severity vector.

CVE-2026-82605: BareBones BBEdit Lasso Language Tokenizer infinite loop

Affected Software

Remediation

Event History

Frequently Asked Questions

Which BBEdit versions need to be remediated?

Can this be exploited over the network without an account?

What is the operational impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which BBEdit versions need to be remediated?

Can this be exploited over the network without an account?

What is the operational impact if exploitation succeeds?