Vulnerability-Lookup

RHSA-2026:47982

Vulnerability from csaf_opensuse - Published: 2026-07-29 00:00 - Updated: 2026-09-16 18:41

Summary

security update for vim

Severity

Important

Notes

Title of the patch: security update for vim

Description of the patch: This security update provides a functional equivalent of RHSA-2026:47982. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2026:47982.

Patchnames: RHSA-2026:47982

CVE-2026-55693

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 5 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 9:vim-X11-2:8.2.2637-26.el9_8.13.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:vim-common-2:8.2.2637-26.el9_8.13.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:vim-enhanced-2:8.2.2637-26.el9_8.13.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:vim-filesystem-2:8.2.2637-26.el9_8.13.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:vim-minimal-2:8.2.2637-26.el9_8.13.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-57455

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 5 products, the same list as for CVE-2026-55693

Threats

Impact moderate

CVE-2026-57456

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 5 products, the same list as for CVE-2026-55693

Threats

Impact important

CVE-2026-59856

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 5 products, the same list as for CVE-2026-55693

Threats

Impact important

CVE-2026-59858

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 5 products, the same list as for CVE-2026-55693

Threats

Impact important

References

19 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/r…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://www.suse.com/security/cve/CVE-2026-55693/	self
https://www.suse.com/security/cve/CVE-2026-57455/	self
https://www.suse.com/security/cve/CVE-2026-57456/	self
https://www.suse.com/security/cve/CVE-2026-59856/	self
https://www.suse.com/security/cve/CVE-2026-59858/	self
https://www.suse.com/security/cve/CVE-2026-55693	external
https://bugzilla.suse.com/1269300	external
https://www.suse.com/security/cve/CVE-2026-57455	external
https://bugzilla.suse.com/1269293	external
https://www.suse.com/security/cve/CVE-2026-57456	external
https://bugzilla.suse.com/1269292	external
https://www.suse.com/security/cve/CVE-2026-59856	external
https://bugzilla.suse.com/1271194	external
https://www.suse.com/security/cve/CVE-2026-59858	external
https://bugzilla.suse.com/1271193	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for vim",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2026:47982.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2026:47982.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2026:47982",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_47982.json"
      },
      {
        "category": "self",
        "summary": "URL for RHSA-2026:47982",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-July/007226.html"
      },
      {
        "category": "self",
        "summary": "E-Mail link for RHSA-2026:47982",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-July/007226.html"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-55693 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-55693/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-57455 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-57455/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-57456 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-57456/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59856 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59856/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-59858 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-59858/"
      }
    ],
    "title": "security update for vim",
    "tracking": {
      "current_release_date": "2026-09-16T18:41:28Z",
      "generator": {
        "date": "2026-07-29T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2026:47982",
      "initial_release_date": "2026-07-29T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-07-29T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T18:00:10Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T18:41:28Z",
          "number": "3",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vim-filesystem-2:8.2.2637-26.el9_8.13.noarch",
                "product": {
                  "name": "vim-filesystem-2:8.2.2637-26.el9_8.13.noarch",
                  "product_id": "vim-filesystem-2:8.2.2637-26.el9_8.13.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/vim-filesystem@8.2.2637-26.el9_8.13?arch=noarch\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vim-X11-2:8.2.2637-26.el9_8.13.x86_64",
                "product": {
                  "name": "vim-X11-2:8.2.2637-26.el9_8.13.x86_64",
                  "product_id": "vim-X11-2:8.2.2637-26.el9_8.13.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/vim-X11@8.2.2637-26.el9_8.13?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-common-2:8.2.2637-26.el9_8.13.x86_64",
                "product": {
                  "name": "vim-common-2:8.2.2637-26.el9_8.13.x86_64",
                  "product_id": "vim-common-2:8.2.2637-26.el9_8.13.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/vim-common@8.2.2637-26.el9_8.13?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-enhanced-2:8.2.2637-26.el9_8.13.x86_64",
                "product": {
                  "name": "vim-enhanced-2:8.2.2637-26.el9_8.13.x86_64",
                  "product_id": "vim-enhanced-2:8.2.2637-26.el9_8.13.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/vim-enhanced@8.2.2637-26.el9_8.13?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "vim-minimal-2:8.2.2637-26.el9_8.13.x86_64",
                "product": {
                  "name": "vim-minimal-2:8.2.2637-26.el9_8.13.x86_64",
                  "product_id": "vim-minimal-2:8.2.2637-26.el9_8.13.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/vim-minimal@8.2.2637-26.el9_8.13?arch=x86_64\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 9",
                "product": {
                  "name": "SUSE Liberty Linux 9",
                  "product_id": "SUSE Liberty Linux 9",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-X11-2:8.2.2637-26.el9_8.13.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:vim-X11-2:8.2.2637-26.el9_8.13.x86_64"
        },
        "product_reference": "vim-X11-2:8.2.2637-26.el9_8.13.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-common-2:8.2.2637-26.el9_8.13.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:vim-common-2:8.2.2637-26.el9_8.13.x86_64"
        },
        "product_reference": "vim-common-2:8.2.2637-26.el9_8.13.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-enhanced-2:8.2.2637-26.el9_8.13.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:vim-enhanced-2:8.2.2637-26.el9_8.13.x86_64"
        },
        "product_reference": "vim-enhanced-2:8.2.2637-26.el9_8.13.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-filesystem-2:8.2.2637-26.el9_8.13.noarch as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:vim-filesystem-2:8.2.2637-26.el9_8.13.noarch"
        },
        "product_reference": "vim-filesystem-2:8.2.2637-26.el9_8.13.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "vim-minimal-2:8.2.2637-26.el9_8.13.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:vim-minimal-2:8.2.2637-26.el9_8.13.x86_64"
        },
        "product_reference": "vim-minimal-2:8.2.2637-26.el9_8.13.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-55693",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-55693"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a depth counter. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:vim-X11-2:8.2.2637-26.el9_8.13.x86_64",
          "SUSE Liberty Linux 9:vim-common-2:8.2.2637-26.el9_8.13.x86_64",
          "SUSE Liberty Linux 9:vim-enhanced-2:8.2.2637-26.el9_8.13.x86_64",
          "SUSE Liberty Linux 9:vim-filesystem-2:8.2.2637-26.el9_8.13.noarch",
          "SUSE Liberty Linux 9:vim-minimal-2:8.2.2637-26.el9_8.13.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-55693",
          "url": "https://www.suse.com/security/cve/CVE-2026-55693"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1269300 for CVE-2026-55693",
          "url": "https://bugzilla.suse.com/1269300"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:vim-X11-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-common-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-enhanced-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-filesystem-2:8.2.2637-26.el9_8.13.noarch",
            "SUSE Liberty Linux 9:vim-minimal-2:8.2.2637-26.el9_8.13.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:vim-X11-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-common-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-enhanced-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-filesystem-2:8.2.2637-26.el9_8.13.noarch",
            "SUSE Liberty Linux 9:vim-minimal-2:8.2.2637-26.el9_8.13.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-29T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-55693"
    },
    {
      "cve": "CVE-2026-57455",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-57455"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of spell_soundfold_sofo() in src/spell.c translates a word through a spell file\u0027s SOFO (sound-folding) byte map into a caller-owned result buffer. Its copy loop advances the output index ri with no upper bound and terminates only on the input NUL, writing one byte per input byte into the MAXWLEN-element stack buffer the caller provides. A word longer than MAXWLEN, passed to soundfold() (or reached via sound-based spell suggestion) while a SOFO-based spell language is active, therefore writes past the end of that buffer. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0698.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:vim-X11-2:8.2.2637-26.el9_8.13.x86_64",
          "SUSE Liberty Linux 9:vim-common-2:8.2.2637-26.el9_8.13.x86_64",
          "SUSE Liberty Linux 9:vim-enhanced-2:8.2.2637-26.el9_8.13.x86_64",
          "SUSE Liberty Linux 9:vim-filesystem-2:8.2.2637-26.el9_8.13.noarch",
          "SUSE Liberty Linux 9:vim-minimal-2:8.2.2637-26.el9_8.13.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-57455",
          "url": "https://www.suse.com/security/cve/CVE-2026-57455"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1269293 for CVE-2026-57455",
          "url": "https://bugzilla.suse.com/1269293"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:vim-X11-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-common-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-enhanced-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-filesystem-2:8.2.2637-26.el9_8.13.noarch",
            "SUSE Liberty Linux 9:vim-minimal-2:8.2.2637-26.el9_8.13.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:vim-X11-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-common-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-enhanced-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-filesystem-2:8.2.2637-26.el9_8.13.noarch",
            "SUSE Liberty Linux 9:vim-minimal-2:8.2.2637-26.el9_8.13.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-29T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-57455"
    },
    {
      "cve": "CVE-2026-57456",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-57456"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Vim is an open source, command line text editor. Prior to 9.2.0699, Vim\u0027s Python omni-completion (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. When reconstructing that source, each scope\u0027s docstring is inserted verbatim between triple quotes with no escaping, so a hostile buffer can break out of the triple-quoted literal and execute attacker-controlled Python during omni-completion. This vulnerability is fixed in 9.2.0699.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:vim-X11-2:8.2.2637-26.el9_8.13.x86_64",
          "SUSE Liberty Linux 9:vim-common-2:8.2.2637-26.el9_8.13.x86_64",
          "SUSE Liberty Linux 9:vim-enhanced-2:8.2.2637-26.el9_8.13.x86_64",
          "SUSE Liberty Linux 9:vim-filesystem-2:8.2.2637-26.el9_8.13.noarch",
          "SUSE Liberty Linux 9:vim-minimal-2:8.2.2637-26.el9_8.13.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-57456",
          "url": "https://www.suse.com/security/cve/CVE-2026-57456"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1269292 for CVE-2026-57456",
          "url": "https://bugzilla.suse.com/1269292"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:vim-X11-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-common-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-enhanced-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-filesystem-2:8.2.2637-26.el9_8.13.noarch",
            "SUSE Liberty Linux 9:vim-minimal-2:8.2.2637-26.el9_8.13.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:vim-X11-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-common-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-enhanced-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-filesystem-2:8.2.2637-26.el9_8.13.noarch",
            "SUSE Liberty Linux 9:vim-minimal-2:8.2.2637-26.el9_8.13.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-29T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-57456"
    },
    {
      "cve": "CVE-2026-59856",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59856"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:vim-X11-2:8.2.2637-26.el9_8.13.x86_64",
          "SUSE Liberty Linux 9:vim-common-2:8.2.2637-26.el9_8.13.x86_64",
          "SUSE Liberty Linux 9:vim-enhanced-2:8.2.2637-26.el9_8.13.x86_64",
          "SUSE Liberty Linux 9:vim-filesystem-2:8.2.2637-26.el9_8.13.noarch",
          "SUSE Liberty Linux 9:vim-minimal-2:8.2.2637-26.el9_8.13.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59856",
          "url": "https://www.suse.com/security/cve/CVE-2026-59856"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271194 for CVE-2026-59856",
          "url": "https://bugzilla.suse.com/1271194"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:vim-X11-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-common-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-enhanced-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-filesystem-2:8.2.2637-26.el9_8.13.noarch",
            "SUSE Liberty Linux 9:vim-minimal-2:8.2.2637-26.el9_8.13.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:vim-X11-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-common-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-enhanced-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-filesystem-2:8.2.2637-26.el9_8.13.noarch",
            "SUSE Liberty Linux 9:vim-minimal-2:8.2.2637-26.el9_8.13.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-29T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-59856"
    },
    {
      "cve": "CVE-2026-59858",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-59858"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:vim-X11-2:8.2.2637-26.el9_8.13.x86_64",
          "SUSE Liberty Linux 9:vim-common-2:8.2.2637-26.el9_8.13.x86_64",
          "SUSE Liberty Linux 9:vim-enhanced-2:8.2.2637-26.el9_8.13.x86_64",
          "SUSE Liberty Linux 9:vim-filesystem-2:8.2.2637-26.el9_8.13.noarch",
          "SUSE Liberty Linux 9:vim-minimal-2:8.2.2637-26.el9_8.13.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-59858",
          "url": "https://www.suse.com/security/cve/CVE-2026-59858"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271193 for CVE-2026-59858",
          "url": "https://bugzilla.suse.com/1271193"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:vim-X11-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-common-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-enhanced-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-filesystem-2:8.2.2637-26.el9_8.13.noarch",
            "SUSE Liberty Linux 9:vim-minimal-2:8.2.2637-26.el9_8.13.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:vim-X11-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-common-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-enhanced-2:8.2.2637-26.el9_8.13.x86_64",
            "SUSE Liberty Linux 9:vim-filesystem-2:8.2.2637-26.el9_8.13.noarch",
            "SUSE Liberty Linux 9:vim-minimal-2:8.2.2637-26.el9_8.13.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-29T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-59858"
    }
  ]
}

CVE-2026-55693 (GCVE-0-2026-55693)

Vulnerability from cvelistv5 – Published: 2026-06-25 15:34 – Updated: 2026-06-26 14:03

Title

Vim: Out-of-bounds Write in Spell File Word Count

Summary

Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a depth counter. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653.

Severity

5.7 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-26 14:02 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/a80874d9b84a010…	x_refsource_MISC
https://github.com/vim/vim/releases/tag/v9.2.0653	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0653

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55693",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-26T14:02:19.096753Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-26T14:03:18.357Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0653"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a depth counter. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-25T15:34:33.424Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq"
        },
        {
          "name": "https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7"
        },
        {
          "name": "https://github.com/vim/vim/releases/tag/v9.2.0653",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0653"
        }
      ],
      "source": {
        "advisory": "GHSA-wgh4-64f7-q3jq",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Out-of-bounds Write in Spell File Word Count"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55693",
    "datePublished": "2026-06-25T15:34:33.424Z",
    "dateReserved": "2026-06-17T00:13:10.650Z",
    "dateUpdated": "2026-06-26T14:03:18.357Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-57455 (GCVE-0-2026-57455)

Vulnerability from cvelistv5 – Published: 2026-06-25 15:22 – Updated: 2026-06-25 23:30

Title

Vim: Stack out-of-bounds write in `spell_soundfold_sofo()` via an over-length `soundfold()` argument

Summary

Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of spell_soundfold_sofo() in src/spell.c translates a word through a spell file's SOFO (sound-folding) byte map into a caller-owned result buffer. Its copy loop advances the output index ri with no upper bound and terminates only on the input NUL, writing one byte per input byte into the MAXWLEN-element stack buffer the caller provides. A word longer than MAXWLEN, passed to soundfold() (or reached via sound-based spell suggestion) while a SOFO-based spell language is active, therefore writes past the end of that buffer. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0698.

Severity

4 (Medium)


                        
                          CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-25 23:29 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/497f931f85339d1…	x_refsource_MISC
https://github.com/vim/vim/releases/tag/v9.2.0698	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0698

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-57455",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-25T23:29:19.453165Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-25T23:30:00.892Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0698"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of spell_soundfold_sofo() in src/spell.c translates a word through a spell file\u0027s SOFO (sound-folding) byte map into a caller-owned result buffer. Its copy loop advances the output index ri with no upper bound and terminates only on the input NUL, writing one byte per input byte into the MAXWLEN-element stack buffer the caller provides. A word longer than MAXWLEN, passed to soundfold() (or reached via sound-based spell suggestion) while a SOFO-based spell language is active, therefore writes past the end of that buffer. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0698."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-25T15:22:37.949Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4"
        },
        {
          "name": "https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b"
        },
        {
          "name": "https://github.com/vim/vim/releases/tag/v9.2.0698",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0698"
        }
      ],
      "source": {
        "advisory": "GHSA-q8mh-6qm3-25g4",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Stack out-of-bounds write in `spell_soundfold_sofo()` via an over-length `soundfold()` argument"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-57455",
    "datePublished": "2026-06-25T15:22:37.949Z",
    "dateReserved": "2026-06-24T13:21:20.730Z",
    "dateUpdated": "2026-06-25T23:30:00.892Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-57456 (GCVE-0-2026-57456)

Vulnerability from cvelistv5 – Published: 2026-06-25 15:16 – Updated: 2026-06-26 03:55

Title

Vim: Arbitrary Code Execution via Python Omni-Completion Docstrings

Summary

Vim is an open source, command line text editor. Prior to 9.2.0699, Vim's Python omni-completion (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. When reconstructing that source, each scope's docstring is inserted verbatim between triple quotes with no escaping, so a hostile buffer can break out of the triple-quoted literal and execute attacker-controlled Python during omni-completion. This vulnerability is fixed in 9.2.0699.

Severity

8.4 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-25 00:00 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/cce141c42740f12…	x_refsource_MISC
https://github.com/vim/vim/releases/tag/v9.2.0699	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0699

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-57456",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-25T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-26T03:55:53.888Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0699"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to 9.2.0699, Vim\u0027s Python omni-completion (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. When reconstructing that source, each scope\u0027s docstring is inserted verbatim between triple quotes with no escaping, so a hostile buffer can break out of the triple-quoted literal and execute attacker-controlled Python during omni-completion. This vulnerability is fixed in 9.2.0699."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-25T15:16:16.015Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3"
        },
        {
          "name": "https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8"
        },
        {
          "name": "https://github.com/vim/vim/releases/tag/v9.2.0699",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0699"
        }
      ],
      "source": {
        "advisory": "GHSA-ppj8-wqjf-6fp3",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Arbitrary Code Execution via Python Omni-Completion Docstrings"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-57456",
    "datePublished": "2026-06-25T15:16:16.015Z",
    "dateReserved": "2026-06-24T13:21:20.731Z",
    "dateUpdated": "2026-06-26T03:55:53.888Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59856 (GCVE-0-2026-59856)

Vulnerability from cvelistv5 – Published: 2026-07-09 22:39 – Updated: 2026-07-14 03:55

Title

Vim: Arbitrary Code Execution via PHP Omni-Completion

Summary

Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736.

Severity

8.4 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-13 00:00 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/43afc581a37a357…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0736

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59856",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-13T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T03:55:39.477Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0736"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honored as an Ex command separator, the remainder of the name is run as Ex commands; via the :! command this allows arbitrary operating-system command execution when a victim opens a crafted PHP file and invokes omni-completion. This issue is fixed in version 9.2.0736."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-09T22:39:01.803Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-fh26-8f79-wj97",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-fh26-8f79-wj97"
        },
        {
          "name": "https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24"
        }
      ],
      "source": {
        "advisory": "GHSA-fh26-8f79-wj97",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Arbitrary Code Execution via PHP Omni-Completion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59856",
    "datePublished": "2026-07-09T22:39:01.803Z",
    "dateReserved": "2026-07-07T15:41:53.606Z",
    "dateUpdated": "2026-07-14T03:55:39.477Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59858 (GCVE-0-2026-59858)

Vulnerability from cvelistv5 – Published: 2026-07-09 22:37 – Updated: 2026-07-14 03:55

Title

Vim: Arbitrary Code Execution via C Omni-Completion

Summary

Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735.

Severity

8.4 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-13 00:00 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/vim/vim/security/advisories/GH…	x_refsource_CONFIRM
https://github.com/vim/vim/commit/6b611b0d15603c5…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
vim	vim	Affected: < 9.2.0735

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59858",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-13T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T03:55:38.697Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vim",
          "vendor": "vim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 9.2.0735"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitrary Ex command; opening a hostile .c file whose project tags file contains such an entry and invoking C omni-completion runs that command as the editing user. This issue is fixed in version 9.2.0735."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-09T22:37:52.789Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/vim/vim/security/advisories/GHSA-mf92-v4xw-j45x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/vim/vim/security/advisories/GHSA-mf92-v4xw-j45x"
        },
        {
          "name": "https://github.com/vim/vim/commit/6b611b0d15603c52ebdad17172b0232b4f65704e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vim/vim/commit/6b611b0d15603c52ebdad17172b0232b4f65704e"
        }
      ],
      "source": {
        "advisory": "GHSA-mf92-v4xw-j45x",
        "discovery": "UNKNOWN"
      },
      "title": "Vim: Arbitrary Code Execution via C Omni-Completion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59858",
    "datePublished": "2026-07-09T22:37:52.789Z",
    "dateReserved": "2026-07-07T15:41:53.606Z",
    "dateUpdated": "2026-07-14T03:55:38.697Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:47982

CVE-2026-55693 (GCVE-0-2026-55693)

CVE-2026-57455 (GCVE-0-2026-57455)

CVE-2026-57456 (GCVE-0-2026-57456)

CVE-2026-59856 (GCVE-0-2026-59856)

CVE-2026-59858 (GCVE-0-2026-59858)

Tags

Sightings

Nomenclature

Related by attack behaviour