Several stack buffer overflows and pointer overflows in editorconfig-core-c
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
editorconfig-core-c is theEditorConfig core library written in C (for use by plugins supporting EditorConfig parsing). In affected versions several overflows may occur in switch case '[' when the input pattern contains many escaped characters. The added backslashes leave too little space in the output pattern when processing nested brackets such that the remaining input length exceeds the output capacity. This issue has been addressed in release version 0.12.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| editorconfig | editorconfig-core-c | before 0.12.7 | 0.12.7 | Patch available | CNA |
- editorconfig-core-c Vendoreditorconfig Affected before 0.12.7 Fixed in 0.12.7 Patch available CNA
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:editorconfig:editorconfig:*:*:*:*:*:*:*:* | — | — | editorconfig |
- cpe:2.3:a:editorconfig:editorconfig:*:*:*:*:*:*:*:* Versions — — ·editorconfig
Remediation
- Fix · CNA editorconfig-core-c (editorconfig) Fixed in 0.12.7
Timeline
- 2026-10-02 Threatist record created from CVE-2024-53849
References
Other 5
- https://github.com/editorconfig/editorconfig-core-c/security/advisories/GHSA-475j-wc37-6274
- https://github.com/editorconfig/editorconfig-core-c/pull/103
- https://github.com/editorconfig/editorconfig-core-c/commit/4d5518a0a4e4910c37281ab13a048d0d86999782
- https://github.com/editorconfig/editorconfig-core-c/commit/a8dd5312e08abeab95ff5656d32ed3cb85fba70b
- http://editorconfig.org
More editorconfig vulnerabilities
- TI-2026-29240 editorconfig-core-c has incomplete fix for CVE-2023-0341 CVSS 4.0HIGH 8.6
- TI-2023-00325 Stack Buffer Overflow in editorconfig-core-c CVSS 3.1HIGH 7.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences