vim Schwachstellen (CVE)

7.8Hoch

CVE-2026-43961 vor 2 Monaten

Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution

vim vim; Red Hat Red Hat Hardened Images; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell comma…

7.1Hoch

CVE-2026-73073 vor 2 Monaten

Vim: Arbitrary Ex Command Execution in C Omni-Completion

vim vim

Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an untermina…

8.6Hoch

CVE-2026-73078 vor 3 Monaten

Vim: Arbitrary Code Execution via Netrw Menu Construction

vim vim

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled dire…

8.4Hoch

CVE-2026-73077 vor 3 Monaten

Vim: Arbitrary Code Execution via Shell Keyword Lookup

vim vim

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without…

8.4Hoch

CVE-2026-73076 vor 3 Monaten

Vim: Arbitrary Command Execution via Malicious `.VimballRecord` Entry Replay in `vimball.vim`

vim vim

Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes …

4.6Mittel

CVE-2026-73075 vor 3 Monaten

Vim: Out-of-bounds Access in Popup Opacity Handling

vim vim

Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead o…

7.1Hoch

CVE-2026-73074 vor 3 Monaten

Vim: Heap Buffer Overflow in Text Property Handling

vim vim

Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-proper…

8.5Hoch

CVE-2026-73072 vor 3 Monaten

Vim: Heap Buffer Overflow when Loading a Spell File

vim vim

Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes und…

3.3Niedrig

CVE-2026-73071 vor 3 Monaten

Vim: Use-after-free in JSON Decoding

vim vim

Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read …

6.8Mittel

CVE-2026-73070 vor 3 Monaten

Vim: Stack Buffer Overflow in the Vim Socket Server

vim vim

Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserver_accept(), causing descriptors to overflow fd_set structures in src/channel.c and fixed-siz…

7.7Hoch

CVE-2026-51401 vor 3 Monaten

vim vim

An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/src/os_vms.c

8.4Hoch

CVE-2026-51400 vor 3 Monaten

vim vim

An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/src/os_vms.c

8.4Hoch

CVE-2026-59856 vor 4 Monaten

Vim: Arbitrary Code Execution via PHP Omni-Completion

vim vim

Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via wi…

8.4Hoch

CVE-2026-59858 vor 4 Monaten

Vim: Arbitrary Code Execution via C Omni-Completion

vim vim

Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run th…

5.6Mittel

CVE-2026-59857 vor 4 Monaten

Vim: Out-of-bounds Write in SAL Soundfolding

vim vim

Vim is an open source, command line text editor. Prior to 9.2.0725, the single-byte branch of spell_soundfold_sal() in src/spell.c translates a word through a spell file's SAL sound-folding rules into a caller-owned result buffer, but its result writes are gu…

5.7Mittel

CVE-2026-55693 vor 4 Monaten

Vim: Out-of-bounds Write in Spell File Word Count

vim vim

Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a depth counter. The counter is bounded only by the …

5.5Mittel

CVE-2026-55892 vor 4 Monaten

Vim: Out-of-bounds Write in Spell File Prefix Dump

vim vim

Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the…

5.7Mittel

CVE-2026-55895 vor 4 Monaten

Vim: Vimscript Code Injection in netrw NetrwLocalRmFile() via crafted filename

vim vim

Vim is an open source, command line text editor. Prior to 9.2.0663, a Vimscript code injection vulnerability exists in s:NetrwLocalRmFile() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when deleting a local file from the browser. A fil…

5.3Mittel

CVE-2026-57451 vor 4 Monaten

Vim: Out-of-bounds Read in Text Property Count

vim vim

Vim is an open source, command line text editor. Prior to 9.2.0670, get_text_props() in src/textprop.c reads a uint16 property count stored inline after a line's text and returns it as the number of 32-byte textprop_T entries that follow. The only check is a …

5.5Mittel

CVE-2026-57452 vor 4 Monaten

Vim: Out-of-bounds Read with libsodium-encrypted Files

vim vim

Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05! method (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream heade…

6.5Mittel

CVE-2026-57453 vor 4 Monaten

Vim: PowerShell Command Injection via Unescaped Filename in zip.vim Extraction

vim vim

Vim is an open source, command line text editor. From 9.1.1784 until 9.2.0678, when the bundled zip plugin autoload/zip.vim falls back to PowerShell to browse, read, extract, update or delete entries in a zip archive, it builds the PowerShell command by inser…

6.8Mittel

CVE-2026-57454 vor 4 Monaten

Vim: Out-of-bounds Read with Text Properties

vim vim

Vim is an open source, command line text editor. From 9.2.0320 until 9.2.0679, a crafted undo or swap file can store a virtual-text property whose offset and length point outside the line's property data. When Vim restores or displays such a line it converts …

4.0Mittel

CVE-2026-57455 vor 4 Monaten

Vim: Stack out-of-bounds write in `spell_soundfold_sofo()` via an over-length `soundfold()` argument

vim vim

Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of spell_soundfold_sofo() in src/spell.c translates a word through a spell file's SOFO (sound-folding) byte map into a caller-owned result buffer. Its copy loop advance…

8.4Hoch

CVE-2026-57456 vor 4 Monaten

Vim: Arbitrary Code Execution via Python Omni-Completion Docstrings

vim vim

Vim is an open source, command line text editor. Prior to 9.2.0699, Vim's Python omni-completion (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) executes reconstructed function and class definitions from the current buffer with exec()…

7.5Hoch

CVE-2026-52860 vor 5 Monaten

Vim: Arbitrary Code Execution via Python Omni-Completion

vim vim; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7

Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-completion executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. Python evaluate…