Skip to content
OpenAdvisories
High USN-8657-1 7 CVEs

vim vulnerabilities

Published Aug 20, 2026 · Updated Oct 8, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Vim incorrectly handled memory when decoding
certain JSON input. An attacker could possibly use this issue to cause
Vim to crash, resulting in a denial of service. This issue only affected
Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-73071)

Yazan Balawneh discovered that Vim incorrectly handled memory when
opening certain spell files. An attacker could possibly use this issue to
cause Vim to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2026-73072)

It was discovered that Vim incorrectly handled memory when processing
certain files with a large number of text properties. An attacker could
possibly use this issue to cause Vim to crash, resulting in a denial of
service, or possibly execute arbitrary code. This issue only affected
Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-73074)

It was discovered that Vim incorrectly handled certain vimball files. An
attacker could possibly use this issue to execute arbitrary code.
(CVE-2026-73076)

It was discovered that Vim incorrectly handled shell arguments during
keyword lookups. An attacker could possibly use this issue to execute
arbitrary code. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04
LTS, and Ubuntu 26.04 LTS. (CVE-2026-73077)

David Carliez discovered that Vim incorrectly handled certain directory
paths when constructing netrw menus. An attacker could possibly use this
issue to execute arbitrary code. (CVE-2026-73078)

Fixed packages 7

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS vim 2:8.2.3995-1ubuntu2.35
Ubuntu · 24.04 LTS 24.04:LTS vim 2:9.1.0016-1ubuntu7.19
Ubuntu · 26.04 LTS 26.04:LTS vim 2:9.1.2141-1ubuntu4.8
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS vim 2:7.4.052-1ubuntu3.1+esm32
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS vim 2:7.4.1689-3ubuntu1.5+esm38
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS vim 2:8.0.1453-1ubuntu1.13+esm23
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS vim 2:8.1.2269-1ubuntu5.32+esm12

Vulnerabilities 7

  • High 8.6
    CVE-2026-73078

    Vim: Arbitrary Code Execution via Netrw Menu Construction

    Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled dire…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • High 8.5
    CVE-2026-73072 Public exploit

    Vim: Heap Buffer Overflow when Loading a Spell File

    Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes und…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • High 8.4
    CVE-2026-73076

    Vim: Arbitrary Command Execution via Malicious `.VimballRecord` Entry Replay in `vimball.vim`

    Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes …

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • High 8.4
    CVE-2026-73077

    Vim: Arbitrary Code Execution via Shell Keyword Lookup

    Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • High 7.1
    CVE-2026-73074

    Vim: Heap Buffer Overflow in Text Property Handling

    Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-proper…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • Medium 4.4
    CVE-2026-28417

    Vim has OS Command Injection in netrw

    Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an …

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • Low 3.3
    CVE-2026-73071

    Vim: Use-after-free in JSON Decoding

    Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read …

    vim vim vim vim Debian Ubuntu Azure Linux Alpine

References

  • report
    https://ubuntu.com/security/CVE-2026-28417
  • report
    https://ubuntu.com/security/CVE-2026-73071
  • report
    https://ubuntu.com/security/CVE-2026-73072
  • report
    https://ubuntu.com/security/CVE-2026-73074
  • report
    https://ubuntu.com/security/CVE-2026-73076
  • report
    https://ubuntu.com/security/CVE-2026-73077
  • report
    https://ubuntu.com/security/CVE-2026-73078