CVE-2026-82604: medium-severity vulnerability in BareBones BBEdit
BareBones BBEdit Java Language recursion
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.6%
A flaw has been found in BareBones BBEdit up to 15.5.5. Impacted is an unknown function of the component Java Language Module. This manipulation causes uncontrolled recursion. Remote exploitation of the attack is possible. Upgrading to version 16.0 is recommended to address this issue. You should upgrade the affected component.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X
Affected products
BareBones · BBEditRelated CVEs — BareBones BBEdit
In the same product, most dangerous first.
References
https://ciphersecuritylabs.com/research/articles/fuzzing-bbedit-language-modules-stack-exhaustion-and-infinite-loop-dos-bugshttps://vuldb.com/cve/CVE-2026-82604https://vuldb.com/submit/892839https://vuldb.com/vuln/397106https://vuldb.com/vuln/397106/ctihttps://www.barebones.com/store/bbedit_upgrades.htmlhttps://www.barebones.com/support/bbedit/notes-16.0.html