CVE-2026-40489

Publication date 20 April 2026

Last updated 6 May 2026

Ubuntu priority

Description

editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allows an attacker to crash any application using libeditorconfig by providing a specially crafted directory structure and .editorconfig file. This is an incomplete fix for CVE-2023-0341. The pcre_str buffer was protected in 0.12.6 but the adjacent l_pattern[8194] stack buffer received no equivalent protection. On Ubuntu 24.04, FORTIFY_SOURCE converts the overflow to SIGABRT (DoS). Version 0.12.11 contains an updated fix.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
editorconfig-core	26.04 LTS resolute	Fixed 0.12.10+~0.17.1-3ubuntu0.1
	25.10 questing	Fixed 0.12.9+~0.17.1-1ubuntu2.1
	24.04 LTS noble	Fixed 0.12.7-0.1ubuntu0.1
	22.04 LTS jammy	Needs evaluation
	20.04 LTS focal	Needs evaluation
	18.04 LTS bionic	Needs evaluation
	16.04 LTS xenial	Needs evaluation

Notes

mdeslaur

This is limited to a DoS only because of compiler hardening.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
editorconfig-core	Uptream: 5159be8

References

Related Ubuntu Security Notices (USN)

USN-8238-1
EditorConfig vulnerability
6 May 2026