Description

A flaw has been found in BareBones BBEdit up to 15.5.5. Impacted is an unknown function of the component Java Language Module. This manipulation causes uncontrolled recursion. Remote exploitation of the attack is possible. Upgrading to version 16.0 is recommended to address this issue. You should upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-31T02:17:03.370Z",
  "pubdate": "2026-08-31T02:17:03.370Z",
  "executiveSummary": "A critical vulnerability has been identified within the Java Language Module of BareBones BBEdit versions up to 15.5.5, involving an uncontrolled recursion flaw.\nThis vulnerability allows for remote exploitation, potentially leading to a denial-of-service condition through resource exhaustion.\nThe flaw resides in an unspecified function within the Java Language Module, which fails to properly validate or limit recursive calls when processing input.\nSuccessful exploitation results in application instability or crash, impacting the availability of the BBEdit environment.\nUsers are strongly advised to upgrade to version 16.0 to mitigate this risk, as no other direct workarounds for the internal module logic are currently available.",
  "technicalDetails": "The vulnerability is characterized as an uncontrolled recursion flaw located within the Java Language Module of BareBones BBEdit, affecting all versions up to 15.5.5.\nThe root cause of this vulnerability lies in the improper management of recursive function calls during the parsing or processing of Java source code.\nWhen the affected component encounters specially crafted or malformed input, it triggers a recursive sequence that lacks an appropriate exit condition or depth limitation.\nIn a typical attack scenario, a remote attacker provides a malicious Java file or content that forces the parser to enter an infinite or excessively deep recursive state.\nAs the recursion proceeds, the call stack grows rapidly, consuming available memory and stack space, which eventually leads to a stack overflow or complete process exhaustion.\nBecause the vulnerability is exploitable remotely, an attacker can deliver this trigger via file transfers or external integration points that interface with the Java Language Module.\nNo authentication or elevated privileges are explicitly required to trigger the crash if the application is configured to auto-parse or open files containing the malicious payload.\nThe lack of safety checks within the recursive logic ensures that the application cannot handle deeply nested constructs, effectively providing an entry point for a crash-based denial-of-service attack.\nPost-exploitation, the BBEdit instance will terminate unexpectedly, potentially causing data loss for unsaved files being edited at the time of the crash.\nThe architecture of the Java Language Module lacks the necessary boundary conditions to prevent the stack from being exhausted by deeply nested or cyclical structure definitions commonly found in obfuscated or malicious Java code."
}