CVE-2026-82605: BareBones BBEdit Denial of Service Vulnerability

CVE-2026-82605 Overview

CVE-2026-82605 affects BareBones BBEdit versions up to 15.5.5. The flaw resides in the Lasso Language Tokenizer component, where crafted input triggers an infinite loop condition. Attackers can deliver a malicious file remotely, but exploitation requires the user to open the file in BBEdit. Successful exploitation causes the editor to hang and consume CPU resources, resulting in a denial-of-service condition on the affected macOS workstation. The vulnerability is categorized under [CWE-404] (Improper Resource Shutdown or Release). BareBones addressed the issue in BBEdit 16.0.

Critical Impact
Opening a malicious Lasso-language source file in a vulnerable BBEdit installation causes the application to enter an infinite loop, denying use of the editor and consuming host CPU until the process is terminated.

Affected Products

BareBones BBEdit versions up to and including 15.5.5
BareBones BBEdit component: Lasso Language Tokenizer
Fixed in BareBones BBEdit 16.0

Discovery Timeline

2026-08-31 - CVE-2026-82605 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82605

Vulnerability Analysis

BBEdit ships syntax-highlighting and tokenization modules for many languages, including Lasso. The Lasso Language Tokenizer parses source files and returns tokens for the editor's syntax engine. When the tokenizer encounters a specific malformed byte sequence, its internal state machine fails to advance the read cursor. The parser loops indefinitely over the same input position, and the main application thread stops responding.

The condition is triggered purely by parsing untrusted input. No memory corruption, code execution, or data disclosure results from the flaw. Impact is limited to availability of the editor process on the local host. Because BBEdit typically runs under a standard user account on macOS, the loop does not affect the operating system directly, but it renders the editor unusable until forcibly terminated.

Root Cause

The root cause is improper termination of the tokenizer's parsing loop when a boundary or continuation condition is not met. The tokenizer lacks a guard that guarantees forward progress on each iteration. Fuzzing of BBEdit's language modules by Cipher Security Labs identified the class of issue as an infinite-loop denial of service in the Lasso module.

Attack Vector

An attacker distributes a crafted Lasso source file through email, a shared drive, a Git repository, or a web download. The victim opens the file in BBEdit 15.5.5 or earlier. The tokenizer begins parsing, enters the infinite loop, and the editor becomes unresponsive. Attack complexity is low, but user interaction is required to open the file. No privileges or authentication are needed on the target system.

See the Cipher Security Labs research article and the VulDB entry for CVE-2026-82605 for additional technical context.

Detection Methods for CVE-2026-82605

Indicators of Compromise

BBEdit process (BBEdit) consuming sustained high CPU on a single core shortly after a file open action.
Unresponsive BBEdit UI immediately following the opening of a .lasso, .lasso9, or similar Lasso-associated file extension.
Presence of untrusted Lasso source files in email attachments, downloads, or shared repositories on developer workstations.

Detection Strategies

Inventory macOS endpoints running BBEdit and identify installations at version 15.5.5 or earlier using software asset management or endpoint telemetry.
Alert on BBEdit process CPU utilization exceeding a sustained threshold (for example, 90% on one core for more than 60 seconds) combined with UI thread stalls.
Correlate file-open events for Lasso-language extensions with subsequent process hangs to identify potential exploitation attempts.

Monitoring Recommendations

Track BBEdit version strings across managed macOS fleets and flag hosts below version 16.0.
Monitor delivery channels (mail gateway, download proxy, code repositories) for Lasso source files originating from untrusted senders.
Log user-initiated file open operations tied to BBEdit and retain them for post-incident analysis of DoS events.

How to Mitigate CVE-2026-82605

Immediate Actions Required

Upgrade BBEdit to version 16.0 or later on all macOS endpoints. Refer to the BBEdit 16.0 release notes and the BBEdit upgrades page.
Advise users to avoid opening Lasso-language files received from untrusted or unverified sources until the upgrade is deployed.
If BBEdit hangs after opening a file, terminate the process from Activity Monitor or with kill -9 rather than waiting for recovery.

Patch Information

BareBones fixed the infinite-loop condition in BBEdit 16.0. The vendor advises upgrading the affected component; no configuration-level fix exists for versions 15.5.5 and earlier. Licensed users can obtain 16.0 through the vendor upgrade portal.

Workarounds

Disable or remove the Lasso language module from BBEdit's Language Modules directory to prevent the vulnerable tokenizer from being invoked.
Restrict associations for Lasso-language file extensions so that BBEdit does not automatically parse untrusted files on open.
Scan inbound Lasso source files at the mail and web gateways and quarantine those originating from external senders.

bash

# Identify BBEdit version on macOS endpoints
mdls -name kMDItemVersion /Applications/BBEdit.app

# Remove the Lasso language module as a temporary workaround
rm -f "/Applications/BBEdit.app/Contents/Resources/Language Modules/Lasso.plist"