CVE-2026-28420

Vim is an open source command line text editor. Prior to 9.2.0357, a command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion; if it contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user.

Vim is an open-source command-line text editor. Prior to version 9.2.0078, a stack-buffer-overflow occurs in `build_stl_str_hl()` when rendering a statusline with a multi-byte fill character on a very wide terminal. Version 9.2.0078 patches the issue.

Vim versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) in the swap file recovery logic. Both are caused by unvalidated fields read from crafted pointer blocks within a swap file.

Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a delimiter appears at the start of a line, Vim attempts to read memory immediately preceding the allocated buffer.

Vim is vulnerable to a heap-based buffer overflow out-of-bounds read in its Emacs-style tags file parsing logic prior to version 9.2.0074. When processing a malformed tags file, Vim can read up to 7 bytes beyond the allocated memory boundary. Version 9.2.0074 fixes the issue.

An OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the scp:// protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.

A stack buffer overflow vulnerability exists in Vim's NetBeans integration when processing the specialKeys command. A malicious NetBeans server can overflow the 64-byte keybuf with a single specialKeys command. The issue is fixed in Vim patch v9.1.2148.

Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer passed down to the option callback functions.

Vim 8.0 allows attackers to cause a denial of service (invalid free) or possibly have unspecified other impact via a crafted source (aka -S) file.

Vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax', and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened.