CVE-2026-73076
HighCVSS 8.4Summary
In Vim before 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including OS commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.
Risk Assessment
An attacker can deliver a crafted vimball file that, when opened in Vim, executes arbitrary commands on the victim's machine, potentially leading to full system compromise.
Recommendation
Update Vim to version 9.2.0847 or later to mitigate this vulnerability.
Original NVD description (English source)
Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.