Most recent entries from all

ALSA-2026:66336 — Important: vim security update

Affected: AlmaLinux:10: vim-X11, AlmaLinux:10: vim-common, AlmaLinux:10: vim-data, AlmaLinux:10: vim-enhanced, AlmaLinux:10: vim-filesystem, AlmaLinux:10: vim-minimal, AlmaLinux:10: xxd

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

* vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator (CVE-2026-28420) * vim: Vim: Denial of Service via out-of-bounds write in terminal handling (CVE-2026-52859) * vim: Vim: Denial of Service via crafted spell file (CVE-2026-55892) * vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding (CVE-2026-59857) * vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076) * vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072) * vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078) * vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling (CVE-2026-73077)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-02588

BELL-CVE-2026-28420

Affected: Alpaquita:23: vim, Alpaquita:25: vim, Alpaquita:stream: vim

certfr-2026-avi-0232 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Elles permettent à un attaquant de provoqu…

certfr-2026-avi-0232

EUVD-2026-273987

fkie_cve-2026-28420

Vim is an open source, command line text editor. Prior to version 9.2.0076, a heap-based buffer overflow WRITE and an out-of-bounds READ exist in Vim's terminal emulator when processing maximum combining characters from Unicode supplementary planes. Version 9.2.0076 fixes the issue.

msrc_CVE-2026-28420 — Vim has Heap-based Buffer Overflow and OOB Read in :terminal

msrc_CVE-2026-28420

OESA-2026-1565 — vim security update

Affected: openEuler:24.03-LTS-SP2: vim, openEuler:24.03-LTS-SP3: vim, openEuler:20.03-LTS-SP4: vim, openEuler:22.03-LTS-SP4: vim, openEuler:24.03-LTS: vim, openEuler:24.03-LTS-SP1: vim

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor &apos;Vi&apos;, with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems. Security Fix(es):

Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the scp:// protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.(CVE-2026-28417)

Vim is an open source, command line text editor. Prior to version 9.2.0074, a heap-based buffer overflow out-of-bounds read exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file, Vim can be tricked into reading up to 7 bytes beyond the allocated memory boundary. Version 9.2.0074 fixes the issue.(CVE-2026-28418)

Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a delimiter appears at the start of a line, Vim attempts to read memory immediately preceding the allocated buffer. Version 9.2.0075 fixes the issue.(CVE-2026-28419)

Vim is an open source, command line text edit…

RHSA-2026:66336 — Red Hat Security Advisory: vim security update

vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator vim: Vim: Denial of Service via out-of-bounds write in terminal handling vim: Vim: Denial of Service via crafted spell file vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding vim: Vim: Heap buffer overflow allows arbitrary code execution vim: Vim: Arbitrary command execution via crafted vimball vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries

RHSA-2026:67956 — Red Hat Security Advisory: Red Hat Update Infrastructure 5.3 security update

perl: Perl: Incorrect regular expression processing via large regular expressions openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server openssl: RPK server signature algorithm selection can dereference a missing certificate xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c openssl: QUIC server may trigger double free when processing INITIAL packet vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking vim: Vim: Denial of Service via out-of-bounds write in terminal handling openssl: excessive memory use buffering DTLS records for a future epoch vim: Vim: Denial of Service via crafted spell file expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding openssl: heap buffer overflow in CMS key unwrapping openssl: untrusted sender DN used as format string in CMP response validation openssl: CMP indefinite cache growth of ExtraCerts openssl: QUIC ACK-only packet retention can cause memory exhaustion openssl: invalid pointer dereference in CMP server via crafted protectionAlg vim: Vim: Heap buffer overflow allows arbitrar…

RLSA-2026:66336 — Important: vim security update

Affected: Rocky Linux:10: vim

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

* vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator (CVE-2026-28420)

* vim: Vim: Denial of Service via out-of-bounds write in terminal handling (CVE-2026-52859)

* vim: Vim: Denial of Service via crafted spell file (CVE-2026-55892)

* vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding (CVE-2026-59857)

* vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076)

* vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072)

* vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078)

* vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling (CVE-2026-73077)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:1051-1 — Security update for vim

Security update for vim

UBUNTU-CVE-2026-28420

Affected: Ubuntu:Pro:14.04:LTS: vim, Ubuntu:Pro:16.04:LTS: vim, Ubuntu:Pro:18.04:LTS: vim, Ubuntu:Pro:20.04:LTS: vim, Ubuntu:22.04:LTS: vim, Ubuntu:24.04:LTS: vim, Ubuntu:25.10: vim, Ubuntu:26.04:LTS: vim

WID-SEC-W-2026-0556 — vim: Mehrere Schwachstellen

Ein lokaler Angreifer kann mehrere Schwachstellen in vim ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu verursachen oder Daten zu manipulieren.