vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling

A vulnerability in Vim's shell script plugins sh.vim, zsh.vim, ps1.vim allows arbitrary code execution if a user selects maliciously crafted text in Visual mode and triggers a keyword lookup, due to improperly escaped shell metacharacters...

vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator

A flaw was found in Vim. A remote attacker could exploit a heap-based buffer overflow and an out-of-bounds read vulnerability in Vim's terminal emulator. This occurs when processing specially crafted Unicode supplementary plane characters, potentially leading to information disclosure and denial ...

vim: Vim: Denial of Service via out-of-bounds write in terminal handling

A flaw was found in Vim, an open-source command-line text editor. This vulnerability allows a program displaying output in a Vim terminal window to trigger an out-of-bounds write by sending a specific byte sequence. This can lead to a crash of the Vim application, resulting in a Denial of Service...

vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding

An out-of-bounds write vulnerability in Vim's spellsoundfoldsal function allows an attacker to corrupt memory and crash the editor Denial of Service by supplying a specially crafted word during spell sound-folding...

Important: Red Hat Security Advisory: vim security update

An update for vim is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

vim: Vim: Heap buffer overflow allows arbitrary code execution

A heap buffer overflow in Vim allows a local attacker to cause a denial of service or potentially execute arbitrary code. The flaw is triggered by processing a specially crafted spell file, where the setsofo function fails to reset internal data between sections, leading to an out-of-bounds write...

RHEL 9 : vim (RHSA-2026:66366)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:66366 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Information disclosure and denial of service...

vim security update

9.1.083-9.0.1.el102.20 - Remove upstream references Orabug: 31197557 2:9.1.083-9.20 - RHEL-253668 CVE-2026-28420 buffer overflow in terminal emulator 2:9.1.083-9.19 - RHEL-215660 CVE-2026-55892 vim: stack out-of-bounds write in dumpprefixes 2:9.1.083-9.18 - RHEL-215683 CVE-2026-59857 vim: stack...

AlmaLinux 8 : vim (ALSA-2026:66348)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:66348 advisory. vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator CVE-2026-28420 vim: Vim: Denial of Service via...

vim security update

8.2.2637-26.0.1.el98.21 - Remove upstream references Orabug: 31197557 2:8.2.2637-26.21 - RHEL-253669 CVE-2026-28420 vim: buffer overflow in terminal emulator 2:8.2.2637-26.20 - RHEL-215664 CVE-2026-55892 vim: stack out-of-bounds write in dumpprefixes 2:8.2.2637-26.19 - RHEL-215684 CVE-2026-59857...

Oracle Linux 10 : ELSA-2026-66336-0: / vim (ELSA-2026-663360)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-663360 advisory. - RHEL-253668 CVE-2026-28420 buffer overflow in terminal emulator - RHEL-215660 CVE-2026-55892 vim: stack out-of-bounds write in dumpprefixes -...

Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator CVE-2026-28420 vim: Vim: Denial of Service via out-of-bounds write in terminal handling CVE-2026-52859 vi...

Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator CVE-2026-28420 vim: Vim: Denial of Service via out-of-bounds write in terminal handling CVE-2026-52859 vi...

ALSA-2026:66348 Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator CVE-2026-28420 vim: Vim: Denial of Service via out-of-bounds write in terminal handling CVE-2026-52859 vi...

vim security update

8.0.1763-31.0.1.el810.7 - Remove upstream references Orabug: 31197557 - Added glibc-gconv-extra to common requires to provide ISO-8859-2 Orabug: 34114984 2:8.0.1763-31.7 - RHEL-253666 CVE-2026-28420 buffer overflow in terminal emulator 2:8.0.1763-31.6 - RHEL-215662 CVE-2026-55892 vim: stack...

RHEL 8 : vim (RHSA-2026:66348)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:66348 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Information disclosure and denial of service...

RHEL 10 : vim (RHSA-2026:66336)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:66336 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Information disclosure and denial of servic...

ALSA-2026:66336 Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator CVE-2026-28420 vim: Vim: Denial of Service via out-of-bounds write in terminal handling CVE-2026-52859 vi...

ALSA-2026:66366 Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator CVE-2026-28420 vim: Vim: Denial of Service via out-of-bounds write in terminal handling CVE-2026-52859 vi...

CVE-2026-73073

A flaw was found in Vim, an open-source command-line text editor. An attacker could craft a malicious tags file that, when processed by Vim's C omni-completion feature, leads to insufficient escaping of input. This vulnerability allows for the execution of arbitrary Ex commands and, subsequently,...