Summary
Srinivas Piskala Ganesh Babu discovered that Vim incorrectly handled
directory names when serializing browsed paths to the netrw history file.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2026-47162)
It was discovered that Vim incorrectly handled step-definition patterns in
the cucumber filetype plugin. An attacker could possibly use this issue to
execute arbitrary code. (CVE-2026-47167)
It was discovered that Vim incorrectly handled import statements during
Python omni-completion. An attacker could possibly use this issue to
execute arbitrary code. (CVE-2026-52858)
Andrej Tomči discovered that Vim incorrectly handled certain terminal
screen cells when taking a snapshot, leading to an out-of-bounds read. An
attacker could possibly use this issue to cause Vim to crash, resulting in
a denial of service. (CVE-2026-52859)
David Carliez discovered that Vim incorrectly handled reconstructed
function and class definitions during Python omni-completion. An attacker
could possibly use this issue to execute arbitrary code. (CVE-2026-52860)
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | vim | 2:8.2.3995-1ubuntu2.32 |
| Ubuntu · 24.04 LTS 24.04:LTS | vim | 2:9.1.0016-1ubuntu7.16 |
| Ubuntu · 25.10 | vim | 2:9.1.0967-1ubuntu6.7 |
| Ubuntu · 26.04 LTS 26.04:LTS | vim | 2:9.1.2141-1ubuntu4.5 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | vim | 2:7.4.052-1ubuntu3.1+esm29 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | vim | 2:7.4.1689-3ubuntu1.5+esm35 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | vim | 2:8.0.1453-1ubuntu1.13+esm20 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | vim | 2:8.1.2269-1ubuntu5.32+esm8 |