CVE-2026-57454
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk2th percentile — higher than 2% of all known CVEs
Summary
A vulnerability in Vim versions 9.2.0320 through 9.2.0679 allows an out-of-bounds heap memory read via a crafted undo or swap file. A specially crafted file can store a virtual-text property with offset and length pointing outside the line's property data, causing an out-of-bounds read when Vim restores or displays such a line.
Risk Assessment
An attacker can cause Vim to crash or disclose adjacent heap memory, potentially leading to leakage of sensitive data.
Recommendation
Update Vim to version 9.2.0679 or later, which contains the fix for this vulnerability.
Original NVD description (English source)
Vim is an open source, command line text editor. From 9.2.0320 until 9.2.0679, a crafted undo or swap file can store a virtual-text property whose offset and length point outside the line's property data. When Vim restores or displays such a line it converts the offset into a pointer and reads the virtual text without bounds checking, causing an out-of-bounds read that can crash Vim or disclose adjacent heap memory. This vulnerability is fixed in 9.2.0679.