Vulnerability-Lookup

WID-SEC-W-2026-2513

Vulnerability from csaf_certbund - Published: 2026-07-23 22:00 - Updated: 2026-08-24 22:00

Summary

vim: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Vim (Vi IMproved) ist eine Weiterentwicklung des Texteditors vi.

Angriff: Ein Angreifer kann mehrere Schwachstellen in vim ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, und um nicht näher spezifizierte Auswirkungen zu verursachen.

Betroffene Betriebssysteme: - Linux - Sonstiges - UNIX - Windows

CVE-2026-73078

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Open Source vim <9.2.0840 Open Source / vim		<9.2.0840
Open Source vim <9.2.0839 Open Source / vim		<9.2.0839

CVE-2026-73077

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Open Source vim <9.2.0839 Open Source / vim		<9.2.0839

CVE-2026-73075

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
Open Source vim <9.2.0840 Open Source / vim		<9.2.0840
Open Source vim <9.2.0839 Open Source / vim		<9.2.0839
Open Source vim <9.2.0843 Open Source / vim		<9.2.0843
Open Source vim <9.2.0841 Open Source / vim		<9.2.0841
Open Source vim <9.2.0842 Open Source / vim		<9.2.0842

CVE-2026-73074

Affected products

Known affected 3 products

Product	Identifier	Version	Remediation
Open Source vim <9.2.0840 Open Source / vim		<9.2.0840
Open Source vim <9.2.0839 Open Source / vim		<9.2.0839
Open Source vim <9.2.0841 Open Source / vim		<9.2.0841

CVE-2026-73070

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Open Source vim <9.2.0840 Open Source / vim		<9.2.0840
Open Source vim <9.2.0839 Open Source / vim		<9.2.0839
Open Source vim <9.2.0841 Open Source / vim		<9.2.0841
Open Source vim <9.2.0842 Open Source / vim		<9.2.0842

References

8 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://github.com/vim/vim/security/advisories/	external
https://github.com/vim/vim/security/advisories/GH…	external
https://github.com/vim/vim/security/advisories/GH…	external
https://github.com/vim/vim/security/advisories/GH…	external
https://github.com/vim/vim/security/advisories/GH…	external
https://github.com/vim/vim/security/advisories/GH…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Vim (Vi IMproved) ist eine Weiterentwicklung des Texteditors vi.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in vim ausnutzen, um beliebigen Programmcode auszuf\u00fchren, um einen Denial of Service Angriff durchzuf\u00fchren, und um nicht n\u00e4her spezifizierte Auswirkungen zu verursachen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-2513 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2513.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-2513 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2513"
      },
      {
        "category": "external",
        "summary": "Vim GitHub vom 2026-07-23",
        "url": "https://github.com/vim/vim/security/advisories/"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-49m8-wwxj-mr69 vom 2026-07-23",
        "url": "https://github.com/vim/vim/security/advisories/GHSA-49m8-wwxj-mr69"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-hm4g-pjfx-m27j vom 2026-07-23",
        "url": "https://github.com/vim/vim/security/advisories/GHSA-hm4g-pjfx-m27j"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-pmvp-6rcj-98p4 vom 2026-07-23",
        "url": "https://github.com/vim/vim/security/advisories/GHSA-pmvp-6rcj-98p4"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-r5v6-q6j8-8qw2 vom 2026-07-23",
        "url": "https://github.com/vim/vim/security/advisories/GHSA-r5v6-q6j8-8qw2"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-rcr7-f3wr-22r2 vom 2026-07-23",
        "url": "https://github.com/vim/vim/security/advisories/GHSA-rcr7-f3wr-22r2"
      }
    ],
    "source_lang": "en-US",
    "title": "vim: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-08-24T22:00:00.000+00:00",
      "generator": {
        "date": "2026-08-25T05:06:07.834+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-2513",
      "initial_release_date": "2026-07-23T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-07-23T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-08-24T22:00:00.000+00:00",
          "number": "2",
          "summary": "CVE-Nummern erg\u00e4nzt"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c9.2.0840",
                "product": {
                  "name": "Open Source vim \u003c9.2.0840",
                  "product_id": "T057199"
                }
              },
              {
                "category": "product_version",
                "name": "9.2.0840",
                "product": {
                  "name": "Open Source vim 9.2.0840",
                  "product_id": "T057199-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vim:vim:9.2.0840"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.2.0839",
                "product": {
                  "name": "Open Source vim \u003c9.2.0839",
                  "product_id": "T057200"
                }
              },
              {
                "category": "product_version",
                "name": "9.2.0839",
                "product": {
                  "name": "Open Source vim 9.2.0839",
                  "product_id": "T057200-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vim:vim:9.2.0839"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.2.0843",
                "product": {
                  "name": "Open Source vim \u003c9.2.0843",
                  "product_id": "T057201"
                }
              },
              {
                "category": "product_version",
                "name": "9.2.0843",
                "product": {
                  "name": "Open Source vim 9.2.0843",
                  "product_id": "T057201-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vim:vim:9.2.0843"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.2.0841",
                "product": {
                  "name": "Open Source vim \u003c9.2.0841",
                  "product_id": "T057202"
                }
              },
              {
                "category": "product_version",
                "name": "9.2.0841",
                "product": {
                  "name": "Open Source vim 9.2.0841",
                  "product_id": "T057202-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vim:vim:9.2.0841"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c9.2.0842",
                "product": {
                  "name": "Open Source vim \u003c9.2.0842",
                  "product_id": "T057203"
                }
              },
              {
                "category": "product_version",
                "name": "9.2.0842",
                "product": {
                  "name": "Open Source vim 9.2.0842",
                  "product_id": "T057203-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vim:vim:9.2.0842"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "vim"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-73078",
      "product_status": {
        "known_affected": [
          "T057199",
          "T057200"
        ]
      },
      "release_date": "2026-07-23T22:00:00.000+00:00",
      "title": "CVE-2026-73078"
    },
    {
      "cve": "CVE-2026-73077",
      "product_status": {
        "known_affected": [
          "T057200"
        ]
      },
      "release_date": "2026-07-23T22:00:00.000+00:00",
      "title": "CVE-2026-73077"
    },
    {
      "cve": "CVE-2026-73075",
      "product_status": {
        "known_affected": [
          "T057199",
          "T057200",
          "T057201",
          "T057202",
          "T057203"
        ]
      },
      "release_date": "2026-07-23T22:00:00.000+00:00",
      "title": "CVE-2026-73075"
    },
    {
      "cve": "CVE-2026-73074",
      "product_status": {
        "known_affected": [
          "T057199",
          "T057200",
          "T057202"
        ]
      },
      "release_date": "2026-07-23T22:00:00.000+00:00",
      "title": "CVE-2026-73074"
    },
    {
      "cve": "CVE-2026-73070",
      "product_status": {
        "known_affected": [
          "T057199",
          "T057200",
          "T057202",
          "T057203"
        ]
      },
      "release_date": "2026-07-23T22:00:00.000+00:00",
      "title": "CVE-2026-73070"
    }
  ]
}

CVE-2026-73070 (GCVE-0-2026-73070)

Vulnerability from cvelistv5 – Published: 2026-08-11 15:21 – Updated: 2026-08-11 15:58

Title

Vim: Stack Buffer Overflow in the Vim Socket Server

Summary

Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserver_accept(), causing descriptors to overflow fd_set structures in src/channel.c and fixed-size struct pollfd arrays in src/os_unix.c, which allows a local process that can connect to the server socket to corrupt stack memory or terminate the Vim server. This issue is fixed in version 9.2.0842.

Severity

6.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 15:56 UTC

CWE

CWE-121 - Stack-based Buffer Overflow

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/5598618b2daf8e3…	x_refsource_MISC
https://github.com/vim/vim/releases/tag/v9.2.0842	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0842

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73070",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T15:56:19.530887Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T15:58:28.409Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0842"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserver_accept(), causing descriptors to overflow fd_set structures in src/channel.c and fixed-size struct pollfd arrays in src/os_unix.c, which allows a local process that can connect to the server socket to corrupt stack memory or terminate the Vim server. This issue is fixed in version 9.2.0842."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121: Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T15:21:49.070Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-49m8-wwxj-mr69",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-49m8-wwxj-mr69"
        },
        {
          "name": "https://github.com/vim/vim/commit/5598618b2daf8e36b3bf0251caaefcf0bf8e85e4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/5598618b2daf8e36b3bf0251caaefcf0bf8e85e4"
        },
        {
          "name": "https://github.com/vim/vim/releases/tag/v9.2.0842",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0842"
        }
      ],
      "source": {
        "advisory": "GHSA-49m8-wwxj-mr69",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Stack Buffer Overflow in the Vim Socket Server"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73070",
    "datePublished": "2026-08-11T15:21:49.070Z",
    "dateReserved": "2026-08-10T19:37:41.444Z",
    "dateUpdated": "2026-08-11T15:58:28.409Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73074 (GCVE-0-2026-73074)

Vulnerability from cvelistv5 – Published: 2026-08-11 15:35 – Updated: 2026-08-12 22:14

Title

Vim: Heap Buffer Overflow in Text Property Handling

Summary

Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 22:09 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/a9336b476fd1a18…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0841

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73074",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T22:09:17.260563Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T22:14:12.887Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0841"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T15:35:07.373Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-hm4g-pjfx-m27j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-hm4g-pjfx-m27j"
        },
        {
          "name": "https://github.com/vim/vim/commit/a9336b476fd1a182e3f79b5f83c0ffb04f8a922b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/a9336b476fd1a182e3f79b5f83c0ffb04f8a922b"
        }
      ],
      "source": {
        "advisory": "GHSA-hm4g-pjfx-m27j",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Heap Buffer Overflow in Text Property Handling"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73074",
    "datePublished": "2026-08-11T15:35:07.373Z",
    "dateReserved": "2026-08-10T19:37:41.444Z",
    "dateUpdated": "2026-08-12T22:14:12.887Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73075 (GCVE-0-2026-73075)

Vulnerability from cvelistv5 – Published: 2026-08-11 15:36 – Updated: 2026-08-11 18:31

Title

Vim: Out-of-bounds Access in Popup Opacity Handling

Summary

Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead of accounting for w_popup_topoff and causing an out-of-bounds read and conditional write. This issue is fixed in version 9.2.0843.

Severity

4.6 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 18:31 UTC

CWE

CWE-124 - Buffer Underwrite ('Buffer Underflow')
CWE-125 - Out-of-bounds Read

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: >= 9.2.0469, < 9.2.0843

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73075",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T18:31:33.867372Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T18:31:48.228Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 9.2.0469, \u003c 9.2.0843"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead of accounting for w_popup_topoff and causing an out-of-bounds read and conditional write. This issue is fixed in version 9.2.0843."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-124",
              "description": "CWE-124: Buffer Underwrite (\u0027Buffer Underflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T15:36:33.066Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-pmvp-6rcj-98p4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-pmvp-6rcj-98p4"
        },
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-pmvp-6rcj-98p4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-pmvp-6rcj-98p4"
        }
      ],
      "source": {
        "advisory": "GHSA-pmvp-6rcj-98p4",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Out-of-bounds Access in Popup Opacity Handling"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73075",
    "datePublished": "2026-08-11T15:36:33.066Z",
    "dateReserved": "2026-08-10T19:37:41.444Z",
    "dateUpdated": "2026-08-11T18:31:48.228Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73077 (GCVE-0-2026-73077)

Vulnerability from cvelistv5 – Published: 2026-08-11 15:39 – Updated: 2026-08-11 18:33

Title

Vim: Arbitrary Code Execution via Shell Keyword Lookup

Summary

Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.

Severity

8.4 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 18:33 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/c5a82fe013e73c9…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0839

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73077",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T18:33:20.954919Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T18:33:31.296Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0839"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T15:39:24.579Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-r5v6-q6j8-8qw2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-r5v6-q6j8-8qw2"
        },
        {
          "name": "https://github.com/vim/vim/commit/c5a82fe013e73c98004ad7cd4f906b1ad1ed610e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/c5a82fe013e73c98004ad7cd4f906b1ad1ed610e"
        }
      ],
      "source": {
        "advisory": "GHSA-r5v6-q6j8-8qw2",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Arbitrary Code Execution via Shell Keyword Lookup"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73077",
    "datePublished": "2026-08-11T15:39:24.579Z",
    "dateReserved": "2026-08-10T19:37:41.444Z",
    "dateUpdated": "2026-08-11T18:33:31.296Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73078 (GCVE-0-2026-73078)

Vulnerability from cvelistv5 – Published: 2026-08-11 15:41 – Updated: 2026-08-11 16:57

Title

Vim: Arbitrary Code Execution via Netrw Menu Construction

Summary

Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 16:56 UTC

CWE

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-184 - Incomplete List of Disallowed Inputs

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/29c6fd090d45205…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0840

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73078",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T16:56:42.968042Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T16:57:05.912Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0840"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-184",
              "description": "CWE-184: Incomplete List of Disallowed Inputs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T15:41:08.048Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-rcr7-f3wr-22r2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-rcr7-f3wr-22r2"
        },
        {
          "name": "https://github.com/vim/vim/commit/29c6fd090d4520592f8be7d9ec81190edf25ef69",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/29c6fd090d4520592f8be7d9ec81190edf25ef69"
        }
      ],
      "source": {
        "advisory": "GHSA-rcr7-f3wr-22r2",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Arbitrary Code Execution via Netrw Menu Construction"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73078",
    "datePublished": "2026-08-11T15:41:08.048Z",
    "dateReserved": "2026-08-10T19:37:41.444Z",
    "dateUpdated": "2026-08-11T16:57:05.912Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

WID-SEC-W-2026-2513

CVE-2026-73070 (GCVE-0-2026-73070)

CVE-2026-73074 (GCVE-0-2026-73074)

CVE-2026-73075 (GCVE-0-2026-73075)

CVE-2026-73077 (GCVE-0-2026-73077)

CVE-2026-73078 (GCVE-0-2026-73078)

Tags

Sightings

Nomenclature