Most recent entries from all

ALSA-2026:66336 — Important: vim security update

2026-10-01T02:13:06.824847+00:00

Affected: AlmaLinux:10: vim-X11, AlmaLinux:10: vim-common, AlmaLinux:10: vim-data, AlmaLinux:10: vim-enhanced, AlmaLinux:10: vim-filesystem, AlmaLinux:10: vim-minimal, AlmaLinux:10: xxd

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

* vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator (CVE-2026-28420) * vim: Vim: Denial of Service via out-of-bounds write in terminal handling (CVE-2026-52859) * vim: Vim: Denial of Service via crafted spell file (CVE-2026-55892) * vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding (CVE-2026-59857) * vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076) * vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072) * vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078) * vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling (CVE-2026-73077)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-15415

2026-10-01T02:13:06.825024+00:00

bdu:2026-15415

BELL-CVE-2026-73076

2026-10-01T02:13:06.825063+00:00

Affected: Alpaquita:23: vim, Alpaquita:25: vim, Alpaquita:stream: vim

fkie_cve-2026-73076

2026-10-01T02:13:06.825103+00:00

Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.

msrc_CVE-2026-73076 — Vim: Arbitrary Command Execution via Malicious `.VimballRecord` Entry Replay in `vimball.vim`

2026-10-01T02:13:06.825151+00:00

msrc_CVE-2026-73076

OESA-2026-3593 — vim security update

2026-10-01T02:13:06.825183+00:00

Affected: openEuler:22.03-LTS-SP4: vim

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems. Security Fix(es):

Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.(CVE-2026-73072)

Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.(CVE-2026-73073)

openSUSE-SU-2026:21671-1 — Security update for vim

2026-10-01T02:13:06.825257+00:00

Security update for vim

RHSA-2026:67956 — Red Hat Security Advisory: Red Hat Update Infrastructure 5.3 security update

2026-10-01T02:13:06.825295+00:00

perl: Perl: Incorrect regular expression processing via large regular expressions openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server openssl: RPK server signature algorithm selection can dereference a missing certificate xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c openssl: QUIC server may trigger double free when processing INITIAL packet vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking vim: Vim: Denial of Service via out-of-bounds write in terminal handling openssl: excessive memory use buffering DTLS records for a future epoch vim: Vim: Denial of Service via crafted spell file expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding openssl: heap buffer overflow in CMS key unwrapping openssl: untrusted sender DN used as format string in CMP response validation openssl: CMP indefinite cache growth of ExtraCerts openssl: QUIC ACK-only packet retention can cause memory exhaustion openssl: invalid pointer dereference in CMP server via crafted protectionAlg vim: Vim: Heap buffer overflow allows arbitrar…

RLSA-2026:66336 — Important: vim security update

2026-10-01T02:13:06.825409+00:00

Affected: Rocky Linux:10: vim

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

* vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator (CVE-2026-28420)

* vim: Vim: Denial of Service via out-of-bounds write in terminal handling (CVE-2026-52859)

* vim: Vim: Denial of Service via crafted spell file (CVE-2026-55892)

* vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding (CVE-2026-59857)

* vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076)

* vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072)

* vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078)

* vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling (CVE-2026-73077)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:23190-1 — Security update for vim

2026-10-01T02:13:06.825468+00:00

Security update for vim

UBUNTU-CVE-2026-73076

2026-10-01T02:13:06.825500+00:00

Affected: Ubuntu:Pro:14.04:LTS: vim, Ubuntu:Pro:16.04:LTS: vim, Ubuntu:Pro:18.04:LTS: vim, Ubuntu:Pro:20.04:LTS: vim, Ubuntu:22.04:LTS: vim, Ubuntu:24.04:LTS: vim, Ubuntu:26.04:LTS: vim

WID-SEC-W-2026-2522 — vim: Mehrere Schwachstellen

2026-10-01T02:13:06.825560+00:00

Ein lokaler Angreifer kann mehrere Schwachstellen in vim ausnutzen, um beliebigen Programmcode mit Benutzerrechten auszuführen, einen Denial-of-Service-Zustand auszulösen oder vertrauliche Informationen offenzulegen.