Description
Vim is an open source, command line text editor. Prior to 9.2.0316, a command injection vulnerability in Vim's netbeans interface allows a malicious netbeans server to execute arbitrary Ex commands when Vim connects to it, via unsanitized strings in the defineAnnoType and specialKeys protocol messages. This vulnerability is fixed in 9.2.0316.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vim | vim | < 9.2.0316 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | vim | 2:9.2.0338-1 | — |
| Debian 13 | vim | 2:9.1.1230-2+deb13u1 | — |
| Debian 12 | vim | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | vim | 2:9.1.2141-1ubuntu4.1 | — |
| Ubuntu 25.10 | vim | 2:9.1.0967-1ubuntu6.3 | — |
| Ubuntu 24.04 LTS | vim | 2:9.1.0016-1ubuntu7.12 | — |
| Ubuntu 22.04 LTS | vim | 2:8.2.3995-1ubuntu2.28 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | vim | 2:8.1.2269-1ubuntu5.32+esm4 | — |
| Ubuntu Pro 18.04 LTS | vim | 2:8.0.1453-1ubuntu1.13+esm16 | — |
| Ubuntu Pro 16.04 LTS | vim | 2:7.4.1689-3ubuntu1.5+esm31 | — |
| Ubuntu Pro 14.04 LTS | vim | 2:7.4.052-1ubuntu3.1+esm25 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | vim +8 | 2:9.2.967-1.1.hum1 | RHSA-2026:57614 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | vim | 9.2.0530-150000.5.94.1 | SUSE-SU-2026:2313-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP4 | vim | 9.2.0530-150000.5.94.1 | SUSE-SU-2026:2313-1 |
| SLE Micro 6.2 | vim | 9.2.0530-160000.1.1 | SUSE-SU-2026:21833-1 |
| SLE Micro 5.4 | vim | 9.2.0530-150000.5.94.1 | SUSE-SU-2026:2313-1 |
| SLE Micro 5.3 | vim | 9.2.0530-150000.5.94.1 | SUSE-SU-2026:2313-1 |
| SLE HPC 15 SP4 | vim | 9.2.0530-150000.5.94.1 | SUSE-SU-2026:2313-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | vim | 9.2.0398-1.1 | openSUSE-SU-2026:10652-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | vim | 9.2.0321-r0 | — |
| Alpine v3.23 | vim | 9.2.0321-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | xxd +6 | 2:9.2.597-1.amzn2023.0.1 | ALAS2023-2026-1862 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | vim | 9.2.0323-1 | — |
Advisories 6
- RHSA-2026:57614 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-1004 vim: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Nov 1, 2026
- SUSE-SU-2026:21833-1 Security update for vim SUSE / openSUSE Security Updates · Jul 9, 2026
- ALAS2023-2026-1862 Important: vim security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 22, 2026
- SUSE-SU-2026:2313-1 Security update for vim SUSE / openSUSE Security Updates · Jun 10, 2026
- openSUSE-SU-2026:10652-1 gvim-9.2.0398-1.1 on GA media SUSE / openSUSE Security Updates · Apr 29, 2026