SB2026041439 - Ubuntu update for vim
Published: April 14, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) NULL pointer dereference (CVE-ID: CVE-2026-32249)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error within the nfa_max_width() function when the NFA regex engine processes a look-behind assertion containing a collection with a combining Unicode character as a range endpoint. A remote attacker can trick the victim into opening a specially crafted file and crash the application.
2) OS Command Injection (CVE-ID: CVE-2026-33412)
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation in the "glob()" function. A remote user can pass specially crafted data to the application and execute arbitrary OS commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) OS Command Injection (CVE-ID: CVE-2026-34982)
The vulnerability allows a remote attacker to execute arbitrary OS commands.
The vulnerability exists due to improper neutralization of special elements used in an OS command in modeline processing for the complete, guitabtooltip, and printheader options and the mapset() function when opening a crafted file. A remote attacker can deliver a specially crafted file to execute arbitrary OS commands.
User interaction is required to open a crafted file.
Remediation
Install update from vendor's website.