CVE-2026-36189 describes a buffer overflow vulnerability in the Uncrustify project affecting version 0.82.0-132-bcc41cbdc. The issue is located in the check_template.cpp source file, impacting the check_template and tokenize_cleanup functions of the uncrustify executable. This vulnerability can be exploited by a local attacker to cause a denial of service. The vulnerability was addressed in a specific commit (68e67b9a1435a1bb173b106fedb4a4f510972bdc). There is no CVSS score or detailed vendor advisory information available to confirm patch status or exploitation in the wild.

The vulnerability allows a local attacker to trigger a denial of service by exploiting a buffer overflow in the uncrustify executable. There is no information about remote exploitation or other impacts such as code execution. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed in commit 68e67b9a1435a1bb173b106fedb4a4f510972bdc, so applying this fix or updating to a version including this commit is recommended once available.