CVE-2026-40489: Buffer Overflow in editorconfig-core-c

CVE-2026-40489 identifies a stack-based buffer overflow in the ec_glob() function of editorconfig-core-c library, used by code editors and plugins for .editorconfig file parsing. By providing a specially crafted directory structure and .editorconfig file, an attacker can crash any application depending on libeditorconfig.

The CVSS score of 8.6 places this vulnerability in the high severity range (severity declared as high). On Ubuntu 24.04 systems with FORTIFY_SOURCE enabled, the overflow is converted to SIGABRT (denial of service). This vulnerability represents a correction to the incomplete fix for CVE-2023-0341: the pcre_str buffer was protected in version 0.12.6, but the adjacent l_pattern[8194] buffer did not receive equivalent protection until version 0.12.11.

Sysadmins and IT teams must identify all applications and plugins depending on editorconfig-core-c in development environments and deployed systems, and verify installed versions. Update immediately to version 0.12.11 or later. On systems where update cannot be performed quickly, implement access controls on .editorconfig files to limit the attacker's ability to provide specially crafted files.