CVE-2023-0341: editorconfig-core-c fixed in 0.12.6

CVE-2023-0341 PUBLISHED CVSS 7.8 HIGH

Stack Buffer Overflow in editorconfig-core-c

Reported by canonical · Published January 31, 2023

editorconfig-core-c is fixed in 0.12.6 (GitHub Packages)

A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
editorconfig-core-c	GitHub Packages	0.12.6
editorconfig	editorconfig	0.12.6

Risk scores

CVSS 3.1

7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Vendor	Product	Versions
EditorConfig	EditorConfig C Core	0
EditorConfig	EditorConfig C Core	0

Timeline

Jan 31, 2023 CVE Published
Feb 1, 2023 EPSS Score (30 in total, the first dated here)
Nov 3, 2025 CVE Updated
Mar 10, 2026 Distribution Patch
Mar 10, 2026 Security Advisory (3 in total, the first dated here)
Apr 18, 2026 PoC Published (2 in total, the first dated here)
May 22, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2023-0341
vulnetix vdb fixes CVE-2023-0341

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-0341/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

patch
technical-description
third-party-advisory
https://lists.debian.org/debian-lts-announce/2024/11/msg00036.html url

Look up in the Resolve Platform →