Skip to content
OpenAdvisories
High USN-8500-1 8 CVEs

vim vulnerabilities

Published Jul 2, 2026 · Updated Jul 2, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Vim incorrectly handled path traversal in the
zip.vim plugin. An attacker could possibly use this issue to overwrite
arbitrary files. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04
LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.
(CVE-2026-35177)

It was discovered that Vim incorrectly handled depth tracking when
processing spell files. An attacker could possibly use this issue to cause
a denial of service. (CVE-2026-55693, CVE-2026-55892)

It was discovered that Vim incorrectly handled filename escaping in the
netrw plugin. An attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04
LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10,
and Ubuntu 26.04 LTS. (CVE-2026-55895)

It was discovered that Vim incorrectly handled length calculations when
opening encrypted files. An attacker could possibly use this issue to cause
a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu
24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-57452)

Dhruv Vishesh Gupta discovered that Vim incorrectly handled quoting of
archive entry names. An attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-57453)

It was discovered that Vim incorrectly handled bounds checking when
translating words through a byte map. An attacker could possibly use this
issue to cause a denial of service. (CVE-2026-57455)

Chenyuan Mi discovered that Vim incorrectly handled docstring escaping
during Python omni-completion. An attacker could possibly use this issue to
execute arbitrary code. (CVE-2026-57456)

Fixed packages 8

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS vim 2:8.2.3995-1ubuntu2.33
Ubuntu · 24.04 LTS 24.04:LTS vim 2:9.1.0016-1ubuntu7.17
Ubuntu · 25.10 vim 2:9.1.0967-1ubuntu6.8
Ubuntu · 26.04 LTS 26.04:LTS vim 2:9.1.2141-1ubuntu4.6
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS vim 2:7.4.052-1ubuntu3.1+esm30
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS vim 2:7.4.1689-3ubuntu1.5+esm36
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS vim 2:8.0.1453-1ubuntu1.13+esm21
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS vim 2:8.1.2269-1ubuntu5.32+esm9

Vulnerabilities 8

  • High 8.4
    CVE-2026-57456

    Vim: Arbitrary Code Execution via Python Omni-Completion Docstrings

    Vim is an open source, command line text editor. Prior to 9.2.0699, Vim's Python omni-completion (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) executes reconstructed function and class definitions from the current buffer with exec()…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2026-57453

    Vim: PowerShell Command Injection via Unescaped Filename in zip.vim Extraction

    Vim is an open source, command line text editor. From 9.1.1784 until 9.2.0678, when the bundled zip plugin autoload/zip.vim falls back to PowerShell to browse, read, extract, update or delete entries in a zip archive, it builds the PowerShell command by inser…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • Medium 5.7
    CVE-2026-55693

    Vim: Out-of-bounds Write in Spell File Word Count

    Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a depth counter. The counter is bounded only by the …

    vim vim vim vim Debian Ubuntu Azure Linux
  • Medium 5.7
    CVE-2026-55895

    Vim: Vimscript Code Injection in netrw NetrwLocalRmFile() via crafted filename

    Vim is an open source, command line text editor. Prior to 9.2.0663, a Vimscript code injection vulnerability exists in s:NetrwLocalRmFile() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when deleting a local file from the browser. A fil…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • Medium 5.5
    CVE-2026-55892

    Vim: Out-of-bounds Write in Spell File Prefix Dump

    Vim is an open source, command line text editor. Prior to 9.2.0662, the dump_prefixes() function in src/spell.c walks a spell-file prefix trie iteratively with a depth counter while dumping the prefixes that apply to a word. The counter is bounded only by the…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • Medium 5.5
    CVE-2026-57452

    Vim: Out-of-bounds Read with libsodium-encrypted Files

    Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05! method (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream heade…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • Medium 4.1
    CVE-2026-35177

    Path traversal issue with zip.vim in Vim

    Vim is an open source, command line text editor. Prior to 9.2.0280, a path traversal bypass in Vim's zip.vim plugin allows overwriting of arbitrary files when opening specially crafted zip archives, circumventing the previous fix for CVE-2025-53906. This vuln…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • Medium 4.0
    CVE-2026-57455

    Vim: Stack out-of-bounds write in `spell_soundfold_sofo()` via an over-length `soundfold()` argument

    Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of spell_soundfold_sofo() in src/spell.c translates a word through a spell file's SOFO (sound-folding) byte map into a caller-owned result buffer. Its copy loop advance…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine

References

  • report
    https://ubuntu.com/security/CVE-2026-35177
  • report
    https://ubuntu.com/security/CVE-2026-55693
  • report
    https://ubuntu.com/security/CVE-2026-55892
  • report
    https://ubuntu.com/security/CVE-2026-55895
  • report
    https://ubuntu.com/security/CVE-2026-57452
  • report
    https://ubuntu.com/security/CVE-2026-57453
  • report
    https://ubuntu.com/security/CVE-2026-57455
  • report
    https://ubuntu.com/security/CVE-2026-57456