CVE-2026-40489

Low

Low Medium High Critical

CVSS Score

Published: Apr 18, 2026

Last Modified: Apr 18, 2026

Vulnerability Description

editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allows an attacker to crash any application using libeditorconfig by providing a specially crafted directory structure and .editorconfig file. This is an incomplete fix for CVE-2023-0341. The pcre_str buffer was protected in 0.12.6 but the adjacent l_pattern[8194] stack buffer received no equivalent protection. On Ubuntu 24.04, FORTIFY_SOURCE converts the overflow to SIGABRT (DoS). Version 0.12.11 contains an updated fix.

Available Security Patches

1 patch available from vendors

View All Patches

SUSE

CVE-2026-40489

Severity

Unknown

Released

Apr 16, 2026

Security Update

View Details Vendor Page

Browse All Security Patches

References & Resources

Severity Details

out of 10.0

Low

Weakness Type (CWE)

CWE-121

Stack-based Buffer Overflow

Description: A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
Exploit Likelihood: High
Typical Severity: High
Abstraction Level: Variant