CyberSecBulletin

EditorConfig vulnerabilities

We track 2 vulnerabilities in EditorConfig products across 3 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on April 18, 2026.

2vulnerabilities
0critical
2high
0exploited
8.2average CVSS score

Latest EditorConfig vulnerabilities

  • 8.6 High severity

    editorconfig-core-c: Stack-based Buffer Overflow

    CVE-2026-40489EditorConfig

    editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allows an attacker to crash any application using libeditorconfig

  • 7.8 High severity

    EditorConfig C Core: Out-of-bounds Write

    CVE-2023-0341EditorConfig

    A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound