CVE-2026-82604: BBEdit Java Module Recursion Vulnerability

CVE-2026-82604 Overview

CVE-2026-82604 is an uncontrolled recursion vulnerability [CWE-404] in BareBones BBEdit versions up to 15.5.5. The flaw resides in the Java Language Module, where malformed input triggers unbounded recursive processing. Remote exploitation is possible when a user opens or previews a crafted file, leading to stack exhaustion and denial of service (DoS) in the editor process. BareBones addressed the issue in BBEdit 16.0.

Critical Impact
Remote attackers can crash BBEdit by delivering a specially crafted Java source file that causes uncontrolled recursion within the Java Language Module, resulting in application-level denial of service.

Affected Products

BareBones BBEdit versions up to and including 15.5.5
Java Language Module component within affected BBEdit builds
macOS installations running vulnerable BBEdit releases

Discovery Timeline

2026-08-31 - CVE-2026-82604 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82604

Vulnerability Analysis

The vulnerability affects the Java Language Module used by BBEdit for syntax parsing, code folding, and function navigation. When the module processes a specifically crafted Java source file, it enters a recursive code path that lacks a termination or depth guard. The recursion consumes the process stack until the application aborts. The bug is a resource-management flaw categorized under [CWE-404] (Improper Resource Shutdown or Release), manifesting as a stack-exhaustion denial of service. Research on the class of bug is documented in the Cipher Security Labs article on fuzzing BBEdit language modules.

Root Cause

The Java Language Module recursively descends into nested language constructs without enforcing a maximum recursion depth or converting recursion to an iterative walk. Deeply nested or malformed syntactic structures amplify each recursion step, exhausting the thread stack. Because the parser runs in the main BBEdit process, stack exhaustion terminates the editor and any unsaved work in memory.

Attack Vector

Exploitation requires user interaction: the target must open, preview, or otherwise trigger language-aware parsing on a hostile .java file. Delivery vectors include email attachments, shared repositories, and files retrieved from web downloads. The attack succeeds over the network but requires the user to load the file into BBEdit. Impact is limited to availability of the BBEdit process — no code execution, privilege escalation, or data disclosure results from the flaw.

No public proof-of-concept code is referenced in the advisory. Additional context is available in the VulDB entry for CVE-2026-82604.

Detection Methods for CVE-2026-82604

Indicators of Compromise

Repeated unexpected crashes of the BBEdit process on macOS shortly after opening .java files from untrusted sources.
macOS crash reports referencing stack overflow or EXC_BAD_ACCESS originating in BBEdit language-module frames.
Presence of unusually large or deeply nested Java source files delivered via email, chat, or shared drives.

Detection Strategies

Inventory endpoints running BBEdit and identify installations at or below version 15.5.5 using software asset management or endpoint telemetry.
Alert on repeated abnormal termination of BBEdit in macOS unified logs and ReportCrash output.
Inspect user download and mail directories for Java files with anomalous depth, size, or repeating token patterns.

Monitoring Recommendations

Forward macOS DiagnosticReports and process-termination events to a centralized logging pipeline for correlation.
Track BBEdit version distribution across managed macOS fleets and flag hosts pinned to vulnerable builds.
Monitor mail and file-sharing gateways for Java attachments delivered to developer user groups.

How to Mitigate CVE-2026-82604

Immediate Actions Required

Upgrade BBEdit to version 16.0 or later on all affected macOS endpoints. Refer to the BBEdit 16.0 release notes.
Restrict opening of Java source files received from untrusted senders until the upgrade is deployed.
Communicate the risk to development teams that regularly handle third-party Java code drops.

Patch Information

BareBones released BBEdit 16.0, which resolves the uncontrolled recursion in the Java Language Module. Licensed users can obtain the upgrade through the BareBones BBEdit upgrades portal. Apply the update through managed software distribution where available.

Workarounds

Disable or avoid the Java Language Module by opening suspect files as plain text (Language menu → (none)) until patched.
Inspect untrusted .java files with a command-line viewer such as less or cat before loading them into BBEdit.
Quarantine incoming Java source archives at the mail or file-sharing gateway for developer accounts on unpatched hosts.

bash

# Verify installed BBEdit version on macOS
/usr/bin/mdls -name kMDItemVersion /Applications/BBEdit.app

# List BBEdit crash reports for triage
ls -lt ~/Library/Logs/DiagnosticReports/ | grep -i BBEdit