CVE-2026-28422

Vim is an open source command line text editor. Prior to 9.2.0357, a command injection vulnerability exists in Vim's tag file processing. When resolving a tag, the filename field from the tags file is passed through wildcard expansion; if it contains backtick syntax (e.g., `command`), Vim executes the embedded command via the system shell with the full privileges of the running user.

Vim versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) in the swap file recovery logic. Both are caused by unvalidated fields read from crafted pointer blocks within a swap file.

Vim, an open-source command-line text editor, prior to version 9.2.0076 contains a heap-based buffer overflow write and an out-of-bounds read in its terminal emulator when processing maximum combining characters from Unicode supplementary planes. Version 9.2.0076 fixes the issue.

Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a delimiter appears at the start of a line, Vim attempts to read memory immediately preceding the allocated buffer.

Vim is vulnerable to a heap-based buffer overflow out-of-bounds read in its Emacs-style tags file parsing logic prior to version 9.2.0074. When processing a malformed tags file, Vim can read up to 7 bytes beyond the allocated memory boundary. Version 9.2.0074 fixes the issue.

An OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the scp:// protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.

A stack buffer overflow vulnerability exists in Vim's NetBeans integration when processing the specialKeys command. A malicious NetBeans server can overflow the 64-byte keybuf with a single specialKeys command. The issue is fixed in Vim patch v9.1.2148.

Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer passed down to the option callback functions.

Vim 8.0 allows attackers to cause a denial of service (invalid free) or possibly have unspecified other impact via a crafted source (aka -S) file.

Vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax', and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened.