OESA-2026-2260

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-2260
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2026-2260.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2026-2260
Upstream
Published
2026-05-09T11:11:14Z
Modified
2026-08-18T01:19:57Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
editorconfig security update
Details

EditorConfig makes it easy to maintain the correct coding style when switching between different text editors and between different projects. The EditorConfig project maintains a file format and plugins for various text editors which allow this file format to be read and used by those editors.

Security Fix(es):

editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to and including 0.12.10 have a stack-based buffer overflow in ec_glob() that allows an attacker to crash any application using libeditorconfig by providing a specially crafted directory structure and .editorconfig file. This is an incomplete fix for CVE-2023-0341. The pcre_str buffer was protected in 0.12.6 but the adjacent l_pattern[8194] stack buffer received no equivalent protection. On Ubuntu 24.04, FORTIFY_SOURCE converts the overflow to SIGABRT (DoS). Version 0.12.11 contains an updated fix.(CVE-2026-40489)

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:24.03-LTS-SP1 / editorconfig

Package

Name
editorconfig
Purl
pkg:rpm/openEuler/editorconfig&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.12.6-3.oe2403sp1

Ecosystem specific 

{
    "aarch64": [
        "editorconfig-0.12.6-3.oe2403sp1.aarch64.rpm",
        "editorconfig-debuginfo-0.12.6-3.oe2403sp1.aarch64.rpm",
        "editorconfig-debugsource-0.12.6-3.oe2403sp1.aarch64.rpm",
        "editorconfig-devel-0.12.6-3.oe2403sp1.aarch64.rpm",
        "editorconfig-libs-0.12.6-3.oe2403sp1.aarch64.rpm"
    ],
    "src": [
        "editorconfig-0.12.6-3.oe2403sp1.src.rpm"
    ],
    "x86_64": [
        "editorconfig-0.12.6-3.oe2403sp1.x86_64.rpm",
        "editorconfig-debuginfo-0.12.6-3.oe2403sp1.x86_64.rpm",
        "editorconfig-debugsource-0.12.6-3.oe2403sp1.x86_64.rpm",
        "editorconfig-devel-0.12.6-3.oe2403sp1.x86_64.rpm",
        "editorconfig-libs-0.12.6-3.oe2403sp1.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-2260.json"