Description
A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| EditorConfig | EditorConfig C Core | < v0.12.6 | v0.12.6 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | editorconfig-core | 0.12.6-0.1 | — |
| Debian 13 | editorconfig-core | 0.12.6-0.1 | — |
| Debian 12 | editorconfig-core | 0.12.6-0.1 | — |
| Debian 11 | editorconfig-core | 0.12.1-1.1+deb11u1 | DLA-3978-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | editorconfig-core | 0.12.1-1.1+deb11u1build0.20.04.1 | USN-7168-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | editorconfig-core | 0.12.5-2ubuntu0.1~esm1 | USN-7168-1, USN-5842-1 |
| Ubuntu Pro 20.04 LTS | editorconfig-core | 0.12.1-1.1ubuntu0.20.04.1~esm1 | USN-5842-1 |
| Ubuntu Pro 18.04 LTS | editorconfig-core | 0.12.1-1.1ubuntu0.18.04.1~esm1 | USN-7168-1, USN-5842-1 |
| Ubuntu Pro 16.04 LTS | editorconfig-core | 0.12.0-2ubuntu0.1~esm1 | USN-7168-1, USN-5842-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP4 | editorconfig-core-c | 0.12.6-bp154.2.3.1 | openSUSE-SU-2023:0102-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.4 | editorconfig-core-c | 0.12.6-bp154.2.3.1 | openSUSE-SU-2023:0102-1 |
Advisories 4
- USN-7168-1 editorconfig-core vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-5842-1 editorconfig-core vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- DLA-3978-1 editorconfig-core - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2023:0102-1 Security update for editorconfig-core-c SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://github.com/editorconfig/editorconfig-core-c/commit/41281ea82fbf24b060a9f69b9c5369350fb0529e patch
- https://litios.github.io/2023/01/14/CVE-2023-0341.html technical-description
- https://ubuntu.com/security/notices/USN-5842-1 third-party-advisory
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZCFE7DXWAAKDJPRKMXHCACKGKNV37IYZ/