Vim vulnerabilities

Vim prior to 9.2.0845 has a vulnerability in StructMembers() in runtime/autoload/ccomplete.vim, which constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845.

Vim, an open source command line text editor, prior to 9.2.0840 has a vulnerability in runtime/plugin/netrwPlugin.vim and runtime/pack/dist/opt/netrw/autoload/netrw.vim where Bookmarks, History, and Targets menu entries are constructed by interpolating attacker-controlled directory paths into executed :menu commands. Functions s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. The issue is fixed in version 9.2.0840.

In Vim before 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including OS commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.

Vim, an open source text editor, has a vulnerability in json_decode_item() in src/json.c that can retain a stale pointer after json_decode_string() invokes channel_fill(), causing the error path to read freed memory when an invalid JSON string spans buffers. Affects versions from 9.2.0511 to 9.2.0844, fixed in 9.2.0844.

Vim, an open source command line text editor, prior to version 9.2.0842 has a vulnerability in the socket server backend in src/socketserver.c that accepts unbounded client connections, causing descriptors to overflow fd_set structures in src/channel.c and fixed-size struct pollfd arrays in src/os_unix.c. A local process that can connect to the server socket can corrupt stack memory or terminate the Vim server. This issue is fixed in version 9.2.0842.

Vim 8.0 allows attackers to cause a denial of service (invalid free) or possibly have unspecified other impact via a crafted source (aka -S) file.

Vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax', and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened.

Vim is an improved version of the Unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. This may lead to the tb_off position within the buffer being out of bounds.

In Vim before 9.1.0764, a use-after-free occurs when closing a buffer and a BufWinLeave auto command reopens the same buffer in a new split window.

A vulnerability in Vim before version 9.2.0272 allows immediate code execution upon opening a crafted file in the default configuration. The issue is due to %{expr} injection in tabpanel lacking the P_MLE flag.

An integer overflow at an unserialize_uep memory allocation site occurs for vim before patch 8.0.0378, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.

An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tree length when reading a corrupted undo file, which may lead to resultant buffer overflows.

Vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a memory allocation site and a resultant buffer overflow.

Vim's netrw plugin contains a vulnerability that allows arbitrary Vimscript execution via a crafted filename with quote characters and expression fragments. This can lead to shell command execution with the privileges of the user running Vim.

In Vim before 9.2.0839, the ftplugin plugins for sh, zsh, and ps1 pass attacker-controlled Visual-mode selections to keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before invoking bash, zsh, or PowerShell, allowing arbitrary OS commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.

Vim, an open source command line text editor, from version 9.2.0469 to 9.2.0843 has a vulnerability in popup_mark_opacity_zindex() in src/popupwin.c that can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, causing an out-of-bounds read and conditional write. This issue is fixed in version 9.2.0843.

In Vim before 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.

In Vim before 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.

In Vim Project version 9.2.0389 and earlier, there is an issue in the vms_fixfilename() function in vim/src/os_vms.c that allows a local attacker to execute arbitrary code.

Vim version 9.2.0389 and earlier has a vulnerability that allows a local attacker to execute arbitrary code via the vms_fixfilename() function in file vim/src/os_vms.c.

In Vim prior to 9.2.0735, the C omni-completion script (ccomplete.vim) improperly interpolates the typeref: or typename: field from a tags file into a :vimgrep pattern executed via :execute. This allows injection of arbitrary Ex commands through a crafted .c file and invoking C omni-completion.

In Vim prior to version 9.2.0725, the spell_soundfold_sal() function in src/spell.c has a stack buffer overflow vulnerability. When translating a word through spell file SAL sound-folding rules, insufficient length checking can cause a one-byte write past the end of the buffer, potentially corrupting the stack frame and crashing the editor.

A vulnerability in Vim prior to 9.2.0736 allows arbitrary OS command execution when a victim opens a crafted PHP file and invokes omni-completion. The issue is due to improper escaping of class or trait names in the phpcomplete.vim script, enabling injection of Ex commands including :!.

In Vim prior to version 9.2.0597, the Python omni-completion function executes reconstructed function and class definitions from the current buffer using exec(). Python evaluates default argument values, parameter annotations, and class base expressions at definition time, so a malicious buffer can execute attacker-controlled Python expressions during omni-completion. The existing g:pythoncomplete_allow_import mitigation does not cover this path because the attacker-controlled code is not a harvested import/from statement.

In Vim, prior to version 9.2.0565, the update_snapshot() function in src/terminal.c copied the visible terminal screen into the scrollback buffer, which could lead to out-of-bounds array access. As a result, a program rendered inside a :terminal window could trigger a crash.

Vim prior to version 9.2.0561 has a security issue related to executing code from malicious .py files when using Python's omni-completion feature. As a result, malicious code can be run in the context of the editing user.

In Vim prior to version 9.2.0495, a Vimscript code injection vulnerability exists in the s:NetrwBookHistSave() function of the netrw plugin. A directory name from the filesystem is interpolated into a single-quoted Vimscript string without escaping embedded single quotes, allowing arbitrary Vimscript execution, including shell commands, when the history file is sourced.

In Vim prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer multiplication, causing a small buffer to be allocated for a write loop that runs many iterations, overflowing the heap. Because the 'spelllang' option can be set from a modeline, a text file modeline can trigger spell file loading if a malicious .spl file has been planted on the runtimepath.

In Vim prior to version 9.2.0435, an OS command injection vulnerability exists in the :find command-line completion. When the path option contains backtick-enclosed shell commands, they are executed during file name completion. Because the path option lacks the P_SECURE flag, it can be set from a modeline, allowing arbitrary command execution when the user opens a file and triggers :find completion.

Vim before version 9.2.0383 has an OS command injection vulnerability in the netrw standard plugin via a crafted URL (e.g., sftp:// or file://). User interaction is required.

Vim prior to version 9.2.0316 has a command injection vulnerability in its netbeans interface. A malicious netbeans server can execute arbitrary Ex commands when Vim connects, via unsanitized strings in defineAnnoType and specialKeys messages.

In Vim, the zip.vim plugin before version 9.2.0280 contains a path traversal bypass that allows overwriting arbitrary files when opening specially crafted zip archives. This vulnerability circumvents the previous fix for CVE-2025-53906.

A vulnerability in Vim prior to version 9.2.0276 allows a modeline sandbox bypass leading to arbitrary OS command execution. The `complete`, `guitabtooltip`, and `printheader` options lack the `P_MLE` flag, and the `mapset()` function is missing a `check_secure()` call, enabling exploitation from sandboxed expressions.

In Vim prior to version 9.2.0202, a command injection vulnerability exists in the glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may execute arbitrary shell commands. This depends on the user's 'shell' setting.

In Vim, the NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a character range (e.g. [0-0\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states. This corrupts the NFA postfix stack, resulting in a segmentation fault when estimating match width for look-behind assertions. This vulnerability is fixed in version 9.2.0137.

In Vim, prior to version 9.1.2132, a heap buffer overflow vulnerability exists in the tag file resolution logic related to the 'helpfile' option. This issue occurs in the get_tagfname() function and involves copying the user-controlled 'helpfile' option value into a fixed-size buffer without bounds checking.

A vulnerability in Vim may lead to a heap-buffer overflow when switching to other buffers with visual mode still active. The issue arises from the improper ending of visual mode, which may result in attempts to access memory beyond the end of a line in a buffer.

Vim prior to version 9.0.2121 has a heap-use-after-free vulnerability that can occur when executing the `:s` command for the first time using a sub-replace-special atom. This may lead to unsafe memory access and potential crashes of the Vim editor.

Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large value, it may be possible to overflow the size of integer.

Vim is an open source command line text editor. When using the z= command, the user may overflow the count with values larger than MAX_INT, which may lead to a crash, although this does not happen in all situations.

Vim is an open source command line text editor that may cause an overflow when parsing relative ex addresses. The issue occurs in the existing overflow check when the line number becomes negative. The impact is low, user interaction is required.

Vim is an open source command line text editor. When getting the count for a normal mode z command, it may overflow for large counts given, which may lead to a crash, although this does not happen in all situations.

Vim is an open source command line text editor. If the count after the :s command is larger than what fits into a (signed) long variable, abort with e_value_too_large. This issue has been addressed in release version 9.0.2108.

Vim is an open source command line text editor. A floating point exception may occur when calculating the line offset for overlong lines and smooth scrolling is enabled with the cpo-settings including the 'n' flag. This issue leads to application crashes.

Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure.

Vim has a use-after-free vulnerability in memory allocated in the `ga_grow_inner` function. This issue can occur when using the `:history` command, leading to an integer overflow and potential use-after-free.