editorconfig vulnerabilities

Products

• editorconfig 2
• editorconfig-core-c 2
• EditorConfig C Core 1

Latest editorconfig CVEs

Newest publication first

1. CVE-2026-40489 editorconfig-core-c has incomplete fix for CVE-2023-0341

   Published 2026-04-18

   High·CVSS 8.6

   editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allows an attacker to crash any application using libeditorconfig by providing a speci...

2. CVE-2024-53849 Several stack buffer overflows and pointer overflows in editorconfig-core-c

   Published 2024-11-26

   Medium·CVSS 4.8

   editorconfig-core-c is theEditorConfig core library written in C (for use by plugins supporting EditorConfig parsing). In affected versions several overflows may occur in switch case '[' when the input pattern contains many escaped characters. The added backslashes leave too litt...

3. CVE-2023-0341 Stack Buffer Overflow in editorconfig-core-c

   Published 2023-01-31

   High·CVSS 7.8

   A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.