CVE-2026-82605

MediumCVSS 4.3

Published: 31/08/2026(UTC)Updated: 31/08/2026(UTC)Translated: 31/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

26th percentile - higher than 26% of all known CVEs

Summary

A vulnerability has been found in BareBones BBEdit up to 15.5.5 in an unknown function of the Lasso Language Tokenizer component. Such manipulation leads to an infinite loop. The attack can be executed remotely. Upgrading to version 16.0 is sufficient to fix this issue.

Risk Assessment

An infinite loop can cause the application to hang or consume high resources, potentially leading to denial of service.

Recommendation

It is recommended to upgrade BBEdit to version 16.0 or later, which contains the fix.

Other vulnerabilities in BBEdit

CVE-2026-82604Medium
A flaw has been found in BareBones BBEdit up to 15.5.5. An unknown function in the Java Language Module causes uncontrolled recursion. Remote exploitation is possible.

Original NVD description (English source)

A vulnerability has been found in BareBones BBEdit up to 15.5.5. The affected element is an unknown function of the component Lasso Language Tokenizer. Such manipulation leads to infinite loop. The attack can be executed remotely. Upgrading to version 16.0 is sufficient to fix this issue. The affected component should be upgraded.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS