GHSA-97xg-vrcq-254h: editorconfig-core-c has incomplete fix for CVE-2023-0341

Q: Which deployments are exposed to this issue?

Applications that use libeditorconfig from editorconfig-core-c versions 0.12.10 or earlier are affected. Exploitation requires the application to process an attacker-controlled directory structure and .editorconfig file.

Q: What impact should be expected on Ubuntu 24.04?

On Ubuntu 24.04, FORTIFY_SOURCE turns the stack-buffer overflow into SIGABRT, resulting in a denial of service through application termination.

Q: What version fixes the incomplete prior remediation?

Version 0.12.11 contains the updated fix. The earlier protection added in 0.12.6 covered the pcre_str buffer but did not protect the adjacent l_pattern[8194] stack buffer.

Published Apr 18, 2026

Updated

editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ecglob() that allows an attacker to crash any application using libeditorconfig by providing a specially crafted directory structure and .editorconfig file. This is an incomplete fix for CVE-2023-0341. The pcrestr buffer was protected in 0.12.6 but the adjacent lpattern[8194] stack buffer received no equivalent protection. On Ubuntu 24.04, FORTIFYSOURCE converts the overflow to SIGABRT (DoS). Version 0.12.11 contains an updated fix.

Affected Software

1 affected component

editorconfig editorconfig-core-c<=0.12.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade editorconfig-core-c to a version that resolves this vulnerability.
Fixed in 0.12.11

Event History

Apr 18, 2026

CVE Published

via OSV·01:24 AM

Data Sourced

via OSV·01:24 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Applications that use libeditorconfig from editorconfig-core-c versions 0.12.10 or earlier are affected. Exploitation requires the application to process an attacker-controlled directory structure and .editorconfig file.

What impact should be expected on Ubuntu 24.04?

On Ubuntu 24.04, FORTIFY_SOURCE turns the stack-buffer overflow into SIGABRT, resulting in a denial of service through application termination.

What version fixes the incomplete prior remediation?

Version 0.12.11 contains the updated fix. The earlier protection added in 0.12.6 covered the pcre_str buffer but did not protect the adjacent l_pattern[8194] stack buffer.

GHSA-97xg-vrcq-254h: editorconfig-core-c has incomplete fix for CVE-2023-0341

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What impact should be expected on Ubuntu 24.04?

What version fixes the incomplete prior remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What impact should be expected on Ubuntu 24.04?

What version fixes the incomplete prior remediation?