CLSA-2026-1791426968 vim: Fix of 3 CVEs

CVE-2026-73072: fix heap buffer overflow in setsofo with a crafted spell file upstream 9.2.0846 - CVE-2026-73076: fix arbitrary command execution via a crafted .VimballRecord vimball member upstream 9.2.0847 - CVE-2026-73078: fix Ex command injection via crafted netrw bookmark/history menu...

CentOS Linux 6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (CENTOS6:CLSA-2026:1784042868)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1784042868 advisory. - Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates...

CentOS Linux 7 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal (CENTOS7:CLSA-2026:1786353169)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1786353169 advisory. - Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates...

CLSA-2026-1789464785 vim: Fix of 3 CVEs

CVE-2026-73072: fix heap buffer overflow in setsofo; reset slsalfirst before the SNSOFO counting loop, since a preceding SNSAL section may have set its entries to -1 via setsalfirst, making the loop under-count colliding multi-byte characters and allocate an undersized list src/spellfile.c,...

CLSA-2026-1789464719 vim: Fix of 3 CVEs

CVE-2026-73072: fix heap buffer overflow in setsofo; reset slsalfirst before the SNSOFO counting loop, since a preceding SNSAL section may have set its entries to -1 via setsalfirst, making the loop under-count colliding multi-byte characters and allocate an undersized list src/spellfile.c,...

CLSA-2026-1789464361 vim: Fix of 3 CVEs

CVE-2026-73072: fix heap buffer overflow in setsofo; reset slsalfirst before the SNSOFO counting loop, since a preceding SNSAL section may have set its entries to -1 via setsalfirst, making the loop under-count colliding multi-byte characters and allocate an undersized list src/spellfile.c,...

CLSA-2026-1789136288 Fix CVE(s): CVE-2026-73073

SECURITY UPDATE: Arbitrary Ex command execution during C omni-completion: s:StructMembers in runtime/autoload/ccomplete.vim interpolates a tags-file typeref/typename value into a :vimgrep pattern with only "/" and "" escaped, so an unclosed "" makes vimgrep pattern skipping fail and a following...

CLSA-2026-1788182469 Fix CVE(s): CVE-2026-73073

SECURITY UPDATE: arbitrary Ex command execution during C omni-completion: escaping only "/" and "\" in the typeref/typename tag field was not enough. With no "/" in the payload an unclosed "" makes :vimgrep's pattern skipping fail, after which the command parser treats a following "|" as a comman...

DEBIAN-CVE-2026-73073

Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command...

CVE-2026-73073 Vim: Arbitrary Ex Command Execution in C Omni-Completion

Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command...

CVE-2026-73073

Prior to Vim 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim builds a vimgrep command from a tags file's typeref:/typename: field without sufficient escaping. A crafted tag entry can inject an unterminated collection and command separator, executing arbitrary Ex/OS commands when a use...

SUSE CVE-2026-73078

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu...

CLSA-2026-1786353169 vim: Fix of CVE-2026-59858

CVE-2026-59858: escape the typeref/typename tags field before interpolating it into the :vimgrep pattern in ccomplete.vim s:StructMembers, preventing arbitrary Ex command execution during C omni-completion upstream 9.2.0735...

CVE-2026-73078

A flaw in Vim's netrw plugin fails to sanitize special characters in directory paths when creating GUI menu entries. Browsing or bookmarking a maliciously crafted path in GUI Vim allows attackers to execute arbitrary OS commands as the running user. Mitigation To mitigate this issue, avoid browsi...

Vim < 9.2.0840 Arbitrary Code Execution (GHSA-rcr7-f3wr-22r2)

The version of Vim installed on the remote host is prior to 9.2.0840. It is, therefore, affected by a vulnerability as referenced in the GHSA-rcr7-f3wr-22r2 advisory. - runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and...

ALPINE-CVE-2026-73078

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu...

CVE-2026-73078

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu...

CVE-2026-73078 Vim: Arbitrary Code Execution via Netrw Menu Construction

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu...

CVE-2026-73078

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu...

Oracle Linux 8 : vim (ELSA-2026-48703)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-48703 advisory. - RHEL-203873 CVE-2026-59858 vim: arbitrary Ex command execution in C omni-completion - RHEL-194055 CVE-2026-55693 vim: out-of-bounds write in...