BBEDit Language Module DoS: CVE-674/CVE-835 + Fix in v16.0

BBEDit Language Module Vulnerability Summary Vulnerability Overview Cipher Security Labs conducted fuzz testing on the language module of BBEDit 15.5.5 and identified two local Denial of Service (DoS) vulnerabilities: Triggering Mechanism: The vulnerabilities are triggered when a user opens a malicious source file provided by an attacker, or when BBEDit restores a previously opened malicious file. Affected Scope Affected Product: BBEDit 15.5.5 (build 430000124) Impact: - CVE-674: Process crash (stack overflow) - CVE-835: Process hang (100% CPU, requiring a forced exit) Payload Size: 700 bytes for CVE-674, 815 bytes for CVE-835 Practical Impact: Local DoS, which may result in data loss if the crash or hang is re-triggered during session restoration Remediation Fixed Version: BBEDit 16.0 (released May 12, 2026) Fix Details: - Lasso Infinite Loop: Fixed the hang caused by NULL bytes - Java Stack Overflow: Fixed the crash caused by unbalanced generic recursion Disclosure Timeline: - April 24: Initial vulnerability report submitted - April 28: Technical report and PoC documentation provided - April 29: Lasso issue: Vendor confirmed reproducibility - April 27: Vendor reported that both issues were resolved - May 12: BBEDit 16.0 released, confirming the fixes POC / Exploit Code CVE-674 Trigger Pattern (Java Parser Stack Overflow) (Nested generic bounds + repetitive pattern, approx. 200 levels of recursion depth) CVE-835 Trigger Pattern (Lasso Tokenizer Infinite Loop) (A Lasso file containing NULL bytes , causing both and conditions to be true within the loop, preventing the loop from advancing) Key Engineering Lessons 1. Recursive parsers require explicit depth limits: The recursion depth of the parser regarding input structure should be explicitly limited and tested 2. Forward progress checks: Ensure that each iteration of a loop either advances by at least one byte or fails fast 3. In-process fuzz testing: Module-level execution provides tighter control and higher throughput 4. DoS should not be overlooked: Session restoration can automatically re-trigger the crash or hang, posing a risk of data loss

Goal Reached Thanks to every supporter — we hit 100%!

BBEDit Language Module DoS: CVE-674/CVE-835 + Fix in v16.0