Skip to content
OpenAdvisories
High · 7.1 CVE-2026-73073 EUVD-2026-60975

Vim: Arbitrary Ex Command Execution in C Omni-Completion

Published Aug 18, 2026 · Updated Aug 18, 2026 · Assigned by GitHub_M

Vendor: vim Product: vim Package: vim Package: vim Package: vim Package: vim Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.

Affected products

VendorProductAffectedFixed
vim vim < 9.2.0845 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 vim 2:9.2.0858-1 —
Debian 13 vim 2:9.1.1230-2+deb13u1 —
Debian 12 vim No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS vim 2:9.1.2141-1ubuntu4.9 USN-8679-2
Ubuntu 24.04 LTS vim 2:9.1.0016-1ubuntu7.20 USN-8679-1
Ubuntu 22.04 LTS vim 2:8.2.3995-1ubuntu2.36 USN-8679-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS vim 2:8.1.2269-1ubuntu5.32+esm13 USN-8679-1
Ubuntu Pro 18.04 LTS vim 2:8.0.1453-1ubuntu1.13+esm24 USN-8679-1
Ubuntu Pro 16.04 LTS vim 2:7.4.1689-3ubuntu1.5+esm39 USN-8679-1
Ubuntu Pro 14.04 LTS vim 2:7.4.052-1ubuntu3.1+esm33 USN-8679-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 vim +1 2:9.1.083-9.el10_2.22 RHSA-2026:75769
RHEL 9 vim +1 2:8.2.2637-26.el9_8.23 RHSA-2026:75768
RHEL 8 vim +1 2:8.0.1763-32.el8_10 RHSA-2026:77359
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 vim +8 9.2.967-1.1.hum1 RHSA-2026:57614

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 xxd +6 2:9.1.083-9.el10_2.22 ALSA-2026:75769
AlmaLinux 9 vim-X11 +4 2:8.2.2637-26.el9_8.23 ALSA-2026:75768
AlmaLinux 8 vim-X11 +4 2:8.0.1763-32.el8_10 ALSA-2026:77359

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 vim 2:9.1.083-9.el10_2.22 RLSA-2026:75769
Rocky Linux 9 vim 2:8.2.2637-26.el9_8.23 RLSA-2026:75768
Rocky Linux 8 vim 2:8.0.1763-32.el8_10 RLSA-2026:77359

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 vim 9.2.0854-r0 —
Alpine v3.23 vim 9.2.0854-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 xxd +6 2:9.2.920-1.amzn2023.0.1 ALAS2023-2026-2108
Amazon Linux 2 xxd +6 2:9.0.2153-1.amzn2.0.11 ALAS2-2026-3883

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 vim 9.2.0976-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 xxd +6 2:9.1.083-9.0.1.el10_2.22 ELSA-2026-75769
Oracle Linux 9 vim-X11 +4 2:8.2.2637-26.0.1.el9_8.23 ELSA-2026-75768
Oracle Linux 8 vim-X11 +4 2:8.0.1763-32.0.1.el8_10 ELSA-2026-77359

Advisories 17

References