editorconfig: editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing
CVE-2026-40489 is fixed in 8 products on 1 platform, first by editorconfig 0.12.1-1.1ubuntu0.18.04.1~esm3, released April 19, 2026. It is not reported as exploited. Patch Radar priority: Routine.
editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allows an attacker to crash any application using libeditorconfig by providing a specially crafted directory structure and .editorconfig file. This is an incomplete fix for CVE-2023-0341. The pcre_str buffer was protected in 0.12.6 but the adjacent l_pattern[8194] stack buffer received no equivalent protection. On Ubuntu 24.04, FORTIFY_SOURCE converts the overflow to SIGABRT (DoS). Version 0.12.11 contains an updated fix.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| editorconfig · Ubuntu 18.04.6 LTS (bionic) | 0.12.1-1.1ubuntu0.18.04.1~esm3 | editorconfig 0.12.1-1.1ubuntu0.18.04.1~esm3 | Apr 19, 2026 |
| editorconfig · Ubuntu 20.04 LTS (focal) | 0.12.1-1.1+deb11u1ubuntu0.1~esm1 | editorconfig 0.12.1-1.1+deb11u1ubuntu0.1~esm1 | Apr 19, 2026 |
| editorconfig · Ubuntu 22.04.1 LTS (jammy) | 0.12.5-2ubuntu0.1~esm3 | editorconfig 0.12.5-2ubuntu0.1~esm3 | Apr 19, 2026 |
| editorconfig · Ubuntu 24.04.5 LTS (noble) | 0.12.7-0.1ubuntu0.1 | editorconfig 0.12.7-0.1ubuntu0.1 | May 15, 2026 |
| editorconfig · Ubuntu 25.10 (questing) | 0.12.9+~0.17.1-1ubuntu2.1 | editorconfig 0.12.9+~0.17.1-1ubuntu2.1 | May 15, 2026 |
| editorconfig · Ubuntu 26.04.1 LTS (resolute) | 0.12.10+~0.17.1-3ubuntu0.1 | editorconfig 0.12.10+~0.17.1-3ubuntu0.1 | Apr 19, 2026 |
| editorconfig · amzn 2023 | 0.12.11-2.amzn2023.0.1 | ALAS2023-2026-1642 | May 11, 2026 |
| editorconfig-core-c · opensuse-leap 16.0 | 0.12.9-160000.3.1 | OPENSUSE-SU-2026:20966-1 | Jun 15, 2026 |
| editorconfig-core-c · sles 15.7 | 0.12.6-150600.3.6.1 | SUSE-SU-2026:2731-1 | Jul 2, 2026 |
| editorconfig-core-c · sles 16.0 | 0.12.9-160000.3.1 | SUSE-SU-2026:22125-1 | Jun 15, 2026 |
| editorconfig-debuginfo · amzn 2023 | 0.12.11-2.amzn2023.0.1 | ALAS2023-2026-1642 | May 11, 2026 |
| editorconfig-debugsource · amzn 2023 | 0.12.11-2.amzn2023.0.1 | ALAS2023-2026-1642 | May 11, 2026 |
| editorconfig-devel · amzn 2023 | 0.12.11-2.amzn2023.0.1 | ALAS2023-2026-1642 | May 11, 2026 |
| editorconfig-libs · amzn 2023 | 0.12.11-2.amzn2023.0.1 | ALAS2023-2026-1642 | May 11, 2026 |
| editorconfig-libs-debuginfo · amzn 2023 | 0.12.11-2.amzn2023.0.1 | ALAS2023-2026-1642 | May 11, 2026 |
| libeditorconfig0 · Ubuntu 18.04.6 LTS (bionic) | 0.12.1-1.1ubuntu0.18.04.1~esm3 | libeditorconfig0 0.12.1-1.1ubuntu0.18.04.1~esm3 | Apr 19, 2026 |
| libeditorconfig0 · Ubuntu 20.04 LTS (focal) | 0.12.1-1.1+deb11u1ubuntu0.1~esm1 | libeditorconfig0 0.12.1-1.1+deb11u1ubuntu0.1~esm1 | Apr 19, 2026 |
| libeditorconfig0 · Ubuntu 22.04.1 LTS (jammy) | 0.12.5-2ubuntu0.1~esm3 | libeditorconfig0 0.12.5-2ubuntu0.1~esm3 | Apr 19, 2026 |
| libeditorconfig0 · Ubuntu 24.04.5 LTS (noble) | 0.12.7-0.1ubuntu0.1 | libeditorconfig0 0.12.7-0.1ubuntu0.1 | May 15, 2026 |
| libeditorconfig0 · Ubuntu 25.10 (questing) | 0.12.9+~0.17.1-1ubuntu2.1 | libeditorconfig0 0.12.9+~0.17.1-1ubuntu2.1 | May 15, 2026 |
| libeditorconfig0 · Ubuntu 26.04.1 LTS (resolute) | 0.12.10+~0.17.1-3ubuntu0.1 | libeditorconfig0 0.12.10+~0.17.1-3ubuntu0.1 | Apr 19, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.