CVE-2026-73070

Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserveraccept, causing descriptors to overflow fdset structures in src/channel.c and fixed-size struct pollfd arrays in src/osunix.c,...

CVE-2026-73070 Vim: Stack Buffer Overflow in the Vim Socket Server

Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserveraccept, causing descriptors to overflow fdset structures in src/channel.c and fixed-size struct pollfd arrays in src/osunix.c,...

Malicious code in kit-vim-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1b76be1956e2772f73d7712934ee4a296d4407df590f6ca4225db7310de916 The package advertises itself as a dependency-free calendar/streak math library but ships a Linux x8664 ELF at dist/internal/calc-math.dat. The main...

MAL-2026-13740 Malicious code in kit-vim-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1b76be1956e2772f73d7712934ee4a296d4407df590f6ca4225db7310de916 The package advertises itself as a dependency-free calendar/streak math library but ships a Linux x8664 ELF at dist/internal/calc-math.dat. The main...

RLSA-2026:38509 Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: command injection when decompressing .tgz archives CVE-2026-46483 vim: Vim: Arbitrary Code Execution via crafted directory names CVE-2026-47162 vim: Vim: Arbitrary code execution via Python omni-completion...

vim security update

An update is available for vim. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Vim Vi IMproved is an updated and improved version of the vi editor. Security...

RLSA-2026:38511 Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: command injection when decompressing .tgz archives CVE-2026-46483 vim: Vim: Arbitrary Code Execution via crafted directory names CVE-2026-47162 vim: Vim: Arbitrary code execution via Python omni-completion...

vim security update

An update is available for vim. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Vim Vi IMproved is an updated and improved version of the vi editor. Security...

RLSA-2026:38510 Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: command injection when decompressing .tgz archives CVE-2026-46483 vim: Vim: Arbitrary Code Execution via crafted directory names CVE-2026-47162 vim: Vim: Arbitrary code execution via Python omni-completion...

vim security update

An update is available for vim. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Vim Vi IMproved is an updated and improved version of the vi editor. Security...

Security Bulletin:Vulnerability in Vim affects IBM Netezza Appliance

Summary The Vim package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2022-2889, CVE-2026-46483 Vulnerability Details CVEID:CVE-2026-46483 DESCRIPTION: Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerabili...

CVE-2026-73076: Improper Control of Generation of Code

Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimballRmVimball later processes the matching record entry, the stored Ex...

CVE-2026-73077: Improper Neutralization of Special Elements used in an OS Command

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments...

PT-2026-70248

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0846 Description The set sofo function in src/spellfile.c reuses the sl sal first array without resetting values previously set by set sal first. A specially crafted spell file containing an SN SAL section before an S...

PT-2026-70251

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0847 Description The runtime/autoload/vimball.vim file allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When the vimballRmVimball function later...

CVE-2026-73072: Heap-based Buffer Overflow

Vim is an open source, command line text editor. Prior to 9.2.0846, setsofo in src/spellfile.c reuses slsalfirst without resetting values left by setsalfirst, so a crafted spell file containing an SNSAL section before an SNSOFO section causes under-counted mapping lists and attacker-influenced...

CVE-2026-73078: Improper Neutralization of Special Elements used in a Command

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu...

PT-2026-70247

Name of the Vulnerable Software and Affected Versions Vim versions 9.2.0511 through 9.2.0843 Description The json decode item function in src/json.c can retain a stale pointer after json decode string calls channel fill to refill and free the current buffer. This occurs when an invalid JSON strin...

PT-2026-70267

Name of the Vulnerable Software and Affected Versions Vim versions prior to 9.2.0839 Description Filetype plugins runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim fail to safely separate shell arguments when passing Visual-mode selections from K through keywordprg...

CVE-2026-73074: Integer Overflow or Wraparound

Vim is an open source, command line text editor. Prior to 9.2.0841, propaddone in src/textprop.c uses the proplen value from gettextprops to increment a uint16t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for non...