CVE-2026-82604

MediumCVSS 4.3

Published: 31/08/2026(UTC)Updated: 31/08/2026(UTC)Translated: 31/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

26th percentile - higher than 26% of all known CVEs

Summary

A flaw has been found in BareBones BBEdit up to 15.5.5. An unknown function in the Java Language Module causes uncontrolled recursion. Remote exploitation is possible.

Risk Assessment

Uncontrolled recursion may lead to system overload or application crash, potentially disrupting services.

Recommendation

Upgrade to version 16.0 to address this issue.

Other vulnerabilities in BBEdit

CVE-2026-82605Medium
A vulnerability has been found in BareBones BBEdit up to 15.5.5 in an unknown function of the Lasso Language Tokenizer component. Such manipulation leads to an infinite loop. The attack can be executed remotely. Upgrading to version 16.0 is sufficient to fix this issue.

Original NVD description (English source)

A flaw has been found in BareBones BBEdit up to 15.5.5. Impacted is an unknown function of the component Java Language Module. This manipulation causes uncontrolled recursion. Remote exploitation of the attack is possible. Upgrading to version 16.0 is recommended to address this issue. You should upgrade the affected component.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS