Vulnerability-Lookup

oesa-2026-3027

Vulnerability from osv_openeuler

Published

2026-07-19 11:11

Modified

2026-08-06 11:11

Summary

vim security update

Details

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05! method (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is fixed in 9.2.0671.(CVE-2026-57452)

Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of spell_soundfold_sofo() in src/spell.c translates a word through a spell file's SOFO (sound-folding) byte map into a caller-owned result buffer. Its copy loop advances the output index ri with no upper bound and terminates only on the input NUL, writing one byte per input byte into the MAXWLEN-element stack buffer the caller provides. A word longer than MAXWLEN, passed to soundfold() (or reached via sound-based spell suggestion) while a SOFO-based spell language is active, therefore writes past the end of that buffer. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0698.(CVE-2026-57455)

Vim is an open source, command line text editor. Prior to 9.2.0699, Vim's Python omni-completion (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. When reconstructing that source, each scope's docstring is inserted verbatim between triple quotes with no escaping, so a hostile buffer can break out of the triple-quoted literal and execute attacker-controlled Python during omni-completion. This vulnerability is fixed in 9.2.0699.(CVE-2026-57456)

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-57452	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-57455	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-57456	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "vim-X11-9.0.2092-38.oe2403sp4.aarch64.rpm",
          "vim-common-9.0.2092-38.oe2403sp4.aarch64.rpm",
          "vim-debuginfo-9.0.2092-38.oe2403sp4.aarch64.rpm",
          "vim-debugsource-9.0.2092-38.oe2403sp4.aarch64.rpm",
          "vim-enhanced-9.0.2092-38.oe2403sp4.aarch64.rpm",
          "vim-minimal-9.0.2092-38.oe2403sp4.aarch64.rpm"
        ],
        "noarch": [
          "vim-filesystem-9.0.2092-38.oe2403sp4.noarch.rpm"
        ],
        "src": [
          "vim-9.0.2092-38.oe2403sp4.src.rpm"
        ],
        "x86_64": [
          "vim-X11-9.0.2092-38.oe2403sp4.x86_64.rpm",
          "vim-common-9.0.2092-38.oe2403sp4.x86_64.rpm",
          "vim-debuginfo-9.0.2092-38.oe2403sp4.x86_64.rpm",
          "vim-debugsource-9.0.2092-38.oe2403sp4.x86_64.rpm",
          "vim-enhanced-9.0.2092-38.oe2403sp4.x86_64.rpm",
          "vim-minimal-9.0.2092-38.oe2403sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP4",
        "name": "vim",
        "purl": "pkg:rpm/openEuler/vim\u0026distro=openEuler-24.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.0.2092-38.oe2403sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "vim-X11-9.0-52.oe2003sp4.aarch64.rpm",
          "vim-common-9.0-52.oe2003sp4.aarch64.rpm",
          "vim-debuginfo-9.0-52.oe2003sp4.aarch64.rpm",
          "vim-debugsource-9.0-52.oe2003sp4.aarch64.rpm",
          "vim-enhanced-9.0-52.oe2003sp4.aarch64.rpm",
          "vim-minimal-9.0-52.oe2003sp4.aarch64.rpm"
        ],
        "noarch": [
          "vim-filesystem-9.0-52.oe2003sp4.noarch.rpm"
        ],
        "src": [
          "vim-9.0-52.oe2003sp4.src.rpm"
        ],
        "x86_64": [
          "vim-X11-9.0-52.oe2003sp4.x86_64.rpm",
          "vim-common-9.0-52.oe2003sp4.x86_64.rpm",
          "vim-debuginfo-9.0-52.oe2003sp4.x86_64.rpm",
          "vim-debugsource-9.0-52.oe2003sp4.x86_64.rpm",
          "vim-enhanced-9.0-52.oe2003sp4.x86_64.rpm",
          "vim-minimal-9.0-52.oe2003sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP4",
        "name": "vim",
        "purl": "pkg:rpm/openEuler/vim\u0026distro=openEuler-20.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.0-52.oe2003sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "vim-X11-9.0-52.oe2203sp4.aarch64.rpm",
          "vim-common-9.0-52.oe2203sp4.aarch64.rpm",
          "vim-debuginfo-9.0-52.oe2203sp4.aarch64.rpm",
          "vim-debugsource-9.0-52.oe2203sp4.aarch64.rpm",
          "vim-enhanced-9.0-52.oe2203sp4.aarch64.rpm",
          "vim-minimal-9.0-52.oe2203sp4.aarch64.rpm"
        ],
        "noarch": [
          "vim-filesystem-9.0-52.oe2203sp4.noarch.rpm"
        ],
        "src": [
          "vim-9.0-52.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "vim-X11-9.0-52.oe2203sp4.x86_64.rpm",
          "vim-common-9.0-52.oe2203sp4.x86_64.rpm",
          "vim-debuginfo-9.0-52.oe2203sp4.x86_64.rpm",
          "vim-debugsource-9.0-52.oe2203sp4.x86_64.rpm",
          "vim-enhanced-9.0-52.oe2203sp4.x86_64.rpm",
          "vim-minimal-9.0-52.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "vim",
        "purl": "pkg:rpm/openEuler/vim\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.0-52.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "vim-X11-9.0.2092-38.oe2403sp1.aarch64.rpm",
          "vim-common-9.0.2092-38.oe2403sp1.aarch64.rpm",
          "vim-debuginfo-9.0.2092-38.oe2403sp1.aarch64.rpm",
          "vim-debugsource-9.0.2092-38.oe2403sp1.aarch64.rpm",
          "vim-enhanced-9.0.2092-38.oe2403sp1.aarch64.rpm",
          "vim-minimal-9.0.2092-38.oe2403sp1.aarch64.rpm"
        ],
        "noarch": [
          "vim-filesystem-9.0.2092-38.oe2403sp1.noarch.rpm"
        ],
        "src": [
          "vim-9.0.2092-38.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "vim-X11-9.0.2092-38.oe2403sp1.x86_64.rpm",
          "vim-common-9.0.2092-38.oe2403sp1.x86_64.rpm",
          "vim-debuginfo-9.0.2092-38.oe2403sp1.x86_64.rpm",
          "vim-debugsource-9.0.2092-38.oe2403sp1.x86_64.rpm",
          "vim-enhanced-9.0.2092-38.oe2403sp1.x86_64.rpm",
          "vim-minimal-9.0.2092-38.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "vim",
        "purl": "pkg:rpm/openEuler/vim\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.0.2092-38.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "vim-X11-9.0.2092-38.oe2403sp3.aarch64.rpm",
          "vim-common-9.0.2092-38.oe2403sp3.aarch64.rpm",
          "vim-debuginfo-9.0.2092-38.oe2403sp3.aarch64.rpm",
          "vim-debugsource-9.0.2092-38.oe2403sp3.aarch64.rpm",
          "vim-enhanced-9.0.2092-38.oe2403sp3.aarch64.rpm",
          "vim-minimal-9.0.2092-38.oe2403sp3.aarch64.rpm"
        ],
        "noarch": [
          "vim-filesystem-9.0.2092-38.oe2403sp3.noarch.rpm"
        ],
        "src": [
          "vim-9.0.2092-38.oe2403sp3.src.rpm"
        ],
        "x86_64": [
          "vim-X11-9.0.2092-38.oe2403sp3.x86_64.rpm",
          "vim-common-9.0.2092-38.oe2403sp3.x86_64.rpm",
          "vim-debuginfo-9.0.2092-38.oe2403sp3.x86_64.rpm",
          "vim-debugsource-9.0.2092-38.oe2403sp3.x86_64.rpm",
          "vim-enhanced-9.0.2092-38.oe2403sp3.x86_64.rpm",
          "vim-minimal-9.0.2092-38.oe2403sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP3",
        "name": "vim",
        "purl": "pkg:rpm/openEuler/vim\u0026distro=openEuler-24.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.0.2092-38.oe2403sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor \u0026amp;apos;Vi\u0026amp;apos;, with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.\r\n\r\nSecurity Fix(es):\n\nVim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05!\nmethod (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is fixed in 9.2.0671.(CVE-2026-57452)\n\nVim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of spell_soundfold_sofo() in src/spell.c translates a word through a spell file\u0026apos;s SOFO (sound-folding) byte map into a caller-owned result buffer. Its copy loop advances the output index ri with no upper bound and terminates only on the input NUL, writing one byte per input byte into the MAXWLEN-element stack buffer the caller provides. A word longer than MAXWLEN, passed to soundfold() (or reached via sound-based spell suggestion) while a SOFO-based spell language is active, therefore writes past the end of that buffer. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0698.(CVE-2026-57455)\n\nVim is an open source, command line text editor. Prior to 9.2.0699, Vim\u0026apos;s Python omni-completion (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. When reconstructing that source, each scope\u0026apos;s docstring is inserted verbatim between triple quotes with no escaping, so a hostile buffer can break out of the triple-quoted literal and execute attacker-controlled Python during omni-completion. This vulnerability is fixed in 9.2.0699.(CVE-2026-57456)",
  "id": "OESA-2026-3027",
  "modified": "2026-08-06T11:11:55Z",
  "published": "2026-07-19T11:11:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3027"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57452"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57455"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57456"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "vim security update",
  "upstream": [
    "CVE-2026-57452",
    "CVE-2026-57455",
    "CVE-2026-57456"
  ]
}

CVE-2026-57452 (GCVE-0-2026-57452)

Vulnerability from cvelistv5 – Published: 2026-06-25 15:27 – Updated: 2026-06-25 15:47

Title

Vim: Out-of-bounds Read with libsodium-encrypted Files

Summary

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-25 15:47 UTC

CWE

CWE-125 - Out-of-bounds Read
CWE-191 - Integer Underflow (Wrap or Wraparound)

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/c8777cec25dcfae…	x_refsource_MISC
https://github.com/vim/vim/releases/tag/v9.2.0671	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0671

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-57452",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-25T15:47:10.061512Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-25T15:47:18.346Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0671"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05!\nmethod (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is fixed in 9.2.0671."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-191",
              "description": "CWE-191: Integer Underflow (Wrap or Wraparound)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-25T15:27:50.147Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-c4j9-wr9j-4486",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-c4j9-wr9j-4486"
        },
        {
          "name": "https://github.com/vim/vim/commit/c8777cec25dcfae89c42e9aff51af61f71c5745f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/c8777cec25dcfae89c42e9aff51af61f71c5745f"
        },
        {
          "name": "https://github.com/vim/vim/releases/tag/v9.2.0671",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0671"
        }
      ],
      "source": {
        "advisory": "GHSA-c4j9-wr9j-4486",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Out-of-bounds Read with libsodium-encrypted Files"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-57452",
    "datePublished": "2026-06-25T15:27:50.147Z",
    "dateReserved": "2026-06-24T13:21:20.730Z",
    "dateUpdated": "2026-06-25T15:47:18.346Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-57455 (GCVE-0-2026-57455)

Vulnerability from cvelistv5 – Published: 2026-06-25 15:22 – Updated: 2026-06-25 23:30

Title

Vim: Stack out-of-bounds write in `spell_soundfold_sofo()` via an over-length `soundfold()` argument

Summary

Severity

4 (Medium)


                        
                          CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-25 23:29 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/497f931f85339d1…	x_refsource_MISC
https://github.com/vim/vim/releases/tag/v9.2.0698	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0698

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-57455",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-25T23:29:19.453165Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-25T23:30:00.892Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0698"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of spell_soundfold_sofo() in src/spell.c translates a word through a spell file\u0027s SOFO (sound-folding) byte map into a caller-owned result buffer. Its copy loop advances the output index ri with no upper bound and terminates only on the input NUL, writing one byte per input byte into the MAXWLEN-element stack buffer the caller provides. A word longer than MAXWLEN, passed to soundfold() (or reached via sound-based spell suggestion) while a SOFO-based spell language is active, therefore writes past the end of that buffer. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0698."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-25T15:22:37.949Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4"
        },
        {
          "name": "https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b"
        },
        {
          "name": "https://github.com/vim/vim/releases/tag/v9.2.0698",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0698"
        }
      ],
      "source": {
        "advisory": "GHSA-q8mh-6qm3-25g4",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Stack out-of-bounds write in `spell_soundfold_sofo()` via an over-length `soundfold()` argument"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-57455",
    "datePublished": "2026-06-25T15:22:37.949Z",
    "dateReserved": "2026-06-24T13:21:20.730Z",
    "dateUpdated": "2026-06-25T23:30:00.892Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-57456 (GCVE-0-2026-57456)

Vulnerability from cvelistv5 – Published: 2026-06-25 15:16 – Updated: 2026-06-26 03:55

Title

Vim: Arbitrary Code Execution via Python Omni-Completion Docstrings

Summary

Severity

8.4 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-25 00:00 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/cce141c42740f12…	x_refsource_MISC
https://github.com/vim/vim/releases/tag/v9.2.0699	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0699

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-57456",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-25T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-26T03:55:53.888Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0699"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to 9.2.0699, Vim\u0027s Python omni-completion (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. When reconstructing that source, each scope\u0027s docstring is inserted verbatim between triple quotes with no escaping, so a hostile buffer can break out of the triple-quoted literal and execute attacker-controlled Python during omni-completion. This vulnerability is fixed in 9.2.0699."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-25T15:16:16.015Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3"
        },
        {
          "name": "https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8"
        },
        {
          "name": "https://github.com/vim/vim/releases/tag/v9.2.0699",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0699"
        }
      ],
      "source": {
        "advisory": "GHSA-ppj8-wqjf-6fp3",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Arbitrary Code Execution via Python Omni-Completion Docstrings"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-57456",
    "datePublished": "2026-06-25T15:16:16.015Z",
    "dateReserved": "2026-06-24T13:21:20.731Z",
    "dateUpdated": "2026-06-26T03:55:53.888Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

oesa-2026-3027

Vulnerability from osv_openeuler

CVE-2026-57452 (GCVE-0-2026-57452)

CVE-2026-57455 (GCVE-0-2026-57455)

CVE-2026-57456 (GCVE-0-2026-57456)

Tags

Sightings

Nomenclature

Related by attack behaviour