Editorconfig CVE-2026-40489

Local filesystem access required to place malicious .editorconfig files where target applications will process them. The attacker must control directory structure and .editorconfig file content in a location that will be parsed by an application using the vulnerable libeditorconfig version. No authentication, special privileges, or user interaction required beyond the application's normal operation of reading .editorconfig files (CVSS PR:N/UI:N). Exploitation is limited to systems running editorconfig-core-c versions ≤0.12.10. Attack complexity is low (AC:L) as crafting the overflow pattern requires only understanding of the l_pattern buffer size (8194 bytes) and basic knowledge of .editorconfig syntax. Exploitation impact is constrained on systems with stack-smashing protections (FORTIFY_SOURCE, stack canaries) where overflow results in SIGABRT rather than arbitrary code execution. The vulnerability is not exploitable remotely unless combined with another vulnerability allowing remote file write to directories processed by affected applications.

Real-world risk is MODERATE with local attack surface constraining widespread impact. CVSS 8.6 HIGH severity accurately reflects the technical impact (VC:H/VI:H/VA:H - full confidentiality, integrity, and availability compromise) but requires important context: AV:L (Local attack vector) limits exposure to attackers with existing filesystem access, PR:N (no privileges required) means any local user can trigger it, and AC:L (low complexity) indicates reliable exploitation. No CISA KEV listing confirms this is not currently exploited in the wild. No public POC code identified in references, though the GitHub security advisory and commit provide sufficient technical detail for skilled attackers to develop exploits. The attack targets applications parsing untrusted .editorconfig files - most commonly developer tools (IDEs, text editors, build systems). Primary risk scenarios: (1) malicious repository cloning where developers unknowingly process attacker-controlled .editorconfig files, (2) shared development environments where untrusted users can write files, (3) CI/CD pipelines processing external repositories. FORTIFY_SOURCE mitigations on modern Linux distributions downgrade impact from potential code execution to denial-of-service, significantly reducing severity in hardened environments. However, legacy systems, custom builds without hardening, or non-Linux platforms remain at higher risk. The incomplete fix history (CVE-2023-0341 → CVE-2026-40489) suggests potential for additional undiscovered buffer handling issues in this codebase. Priority: MEDIUM-HIGH for organizations using affected versions in multi-user or CI/CD environments; MEDIUM for single-user developer workstations with modern OS protections.

An attacker creates a malicious Git repository containing a specially crafted .editorconfig file with deeply nested directory patterns designed to overflow the l_pattern[8194] buffer in ec_glob(). A developer clones this repository and opens it in their IDE (e.g., VS Code with EditorConfig extension, Vim with editorconfig-vim plugin). The IDE automatically parses the .editorconfig file to apply style rules, triggering the buffer overflow. On Ubuntu 24.04 with FORTIFY_SOURCE, the IDE crashes immediately (DoS), disrupting the developer's workflow. On older systems without stack protection, the attacker potentially achieves arbitrary code execution in the context of the editor process, enabling local privilege escalation, data exfiltration from open files, or backdoor installation. The attack requires no user interaction beyond opening the malicious repository, making it particularly effective in supply chain scenarios or against developers who routinely clone external code.