CVE-2026-40489 | editorconfig editorconfig-core-c up to 0.12.10 EditorConfig Parser ec_glob stack-based overflow (GHSA-97xg-vrcq-254h)

VDB-358183 · CVE-2026-40489 · GHSA-97XG-VRCQ-254H EDITORCONFIG EDITORCONFIG-CORE-C UP TO 0.12.10 EDITORCONFIG PARSER EC_GLOB STACK-BASED OVERFLOW HISTORYDIFFRELATEJSONXMLCTI CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score 5.1 $0-$5k 0.38+ Summaryinfo A vulnerability was found in editorconfig editorconfig-core-c up to 0.12.10. It has been rated as critical. Affected by this issue is the function ec_glob of the component EditorConfig Parser. This manipulation causes stack-based overflow. This vulnerability appears as CVE-2026-40489. The attack requires local access. There is no available exploit. Upgrading the affected component is advised. Detailsinfo A vulnerability classified as critical was found in editorconfig editorconfig-core-c up to 0.12.10. Affected by this vulnerability is the function ec_glob of the component EditorConfig Parser. The manipulation with an unknown input leads to a stack-based overflow vulnerability. The CWE definition for the vulnerability is CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is: editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allows an attacker to crash any application using libeditorconfig by providing a specially crafted directory structure and .editorconfig file. This is an incomplete fix for CVE-2023-0341. The pcre_str buffer was protected in 0.12.6 but the adjacent l_pattern[8194] stack buffer received no equivalent protection. On Ubuntu 24.04, FORTIFY_SOURCE converts the overflow to SIGABRT (DoS). Version 0.12.11 contains an updated fix. It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-40489 since 04/13/2026. The exploitation appears to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. Upgrading to version 0.12.11 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 5159be88ad50641d9843289adda791ba300421ff is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version. Productinfo Vendor editorconfig Name editorconfig-core-c Version 0.12.0 0.12.1 0.12.2 0.12.3 0.12.4 0.12.5 0.12.6 0.12.7 0.12.8 0.12.9 0.12.10 License open-source Website Product: https://github.com/editorconfig/editorconfig-core-c/ CPE 2.3info 🔒 🔒 🔒 CPE 2.2info 🔒 🔒 🔒 CVSSv4info VulDB Vector: 🔒 VulDB Reliability: 🔍 CNA CVSS-B Score: 🔒 CNA CVSS-BT Score: 🔒 CNA Vector: 🔒 CVSSv3info VulDB Meta Base Score: 5.3 VulDB Meta Temp Score: 5.1 VulDB Base Score: 5.3 VulDB Temp Score: 5.1 VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv2info Vector Complexity Authentication Confidentiality Integrity Availability Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock VulDB Base Score: 🔒 VulDB Temp Score: 🔒 VulDB Reliability: 🔍 Exploitinginfo Class: Stack-based overflow CWE: CWE-121 / CWE-119 CAPEC: 🔒 ATT&CK: 🔒 Physical: Partially Local: Yes Remote: No Availability: 🔒 Status: Not defined Price Prediction: 🔍 Current Price Estimation: 🔒 0-Day Unlock Unlock Unlock Unlock Today Unlock Unlock Unlock Unlock Threat Intelligenceinfo Interest: 🔍 Active Actors: 🔍 Active APT Groups: 🔍 Countermeasuresinfo Recommended: Upgrade Status: 🔍 0-Day Time: 🔒 Upgrade: editorconfig-core-c 0.12.11 Patch: 5159be88ad50641d9843289adda791ba300421ff Timelineinfo 04/13/2026 CVE reserved 04/18/2026 +5 days Advisory disclosed 04/18/2026 +0 days VulDB entry created 04/18/2026 +0 days VulDB entry last update Sourcesinfo Product: github.com Advisory: GHSA-97xg-vrcq-254h Status: Confirmed CVE: CVE-2026-40489 (🔒) GCVE (CVE): GCVE-0-2026-40489 GCVE (VulDB): GCVE-100-358183 Entryinfo Created: 04/18/2026 09:24 Changes: 04/18/2026 09:24 (72) Complete: 🔍 Cache ID: 99:866:101 Discussion No comments yet. Languages: en. Please log in to comment. ◂ PreviousOverviewNext ▸