SB2026082207 - SUSE update for vim
Published: August 22, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 vulnerabilities.
1) Stack-based buffer overflow (CVE-ID: CVE-2026-73070)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to stack-based buffer overflow in the Vim socket server backend when handling client connections. A local user can connect repeatedly to the server socket to cause a denial of service.
The issue affects Vim instances running as a server with the client-server socket backend enabled. No user interaction is required. On builds using the poll() path, about ten client connections are sufficient, while on builds using the select() path exploitation requires enough connections to exceed FD_SETSIZE and a limit on open files above 1024.
2) Use-after-free (CVE-ID: CVE-2026-73071)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in JSON decoding. A local user can perform a denial of service (DoS) attack on the system.
3) Heap-based buffer overflow (CVE-ID: CVE-2026-73072)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error. A remote attacker can trick a victim to open a specially crafted spell file, trigger a heap-based buffer overflow and cause a denial of service on the target system.
4) Heap-based buffer overflow (CVE-ID: CVE-2026-73074)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to crash the application.
The vulnerability exists due to an integer overflow leading to a heap-based buffer overflow in prop_add_one() in src/textprop.c when adding text properties to a single line. A remote attacker can add a large number of crafted text properties to trigger an out-of-bounds heap write and to cause a denial of service and potentially execute arbitrary code.
Exploitation requires Vim to be built with the textprop feature and requires a script or plugin path that causes 65536 text properties to be added to a single line, such as processing attacker-controlled file contents through a plugin.
5) Buffer underflow (CVE-ID: CVE-2026-73075)
CWE-ID: CWE-124 - Buffer Underwrite ('Buffer Underflow')
CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to read and modify memory outside the bounds of a heap array.
The vulnerability exists due to out-of-bounds write in popup_mark_opacity_zindex() in src/popupwin.c when processing Vim script-created popup windows with the "clipwindow", "opacity", and text property anchor options after the host window is scrolled so the anchor moves above the visible area. A remote attacker can trick the victim into running a crafted Vim script to read and modify memory outside the bounds of a heap array.
The issue is not reachable by opening a file alone, because a modeline cannot call functions.
6) Code Injection (CVE-ID: CVE-2026-73076)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation within the Vimball record file. A remote attacker can execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
7) OS Command Injection (CVE-ID: CVE-2026-73077)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to command injection in the shell filetype plugins when processing a crafted Visual mode selection through keyword lookup with K. A remote attacker can trick the victim into opening a crafted file, selecting a crafted line, and invoking keyword lookup to execute arbitrary code.
User interaction is required to select the crafted text in Visual mode and invoke K, and the issue affects buffers whose filetype resolves to sh, bash, zsh, or PowerShell with filetype plugins enabled.
8) Command injection (CVE-ID: CVE-2026-73078)
CWE-ID: CWE-77 - Command injection
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to command injection in netrw menu construction in runtime/pack/dist/opt/netrw/autoload/netrw.vim when rebuilding bookmarks, history, and targets menus from attacker-controlled directory paths. A remote attacker can supply a specially crafted directory path containing command separators or quotes to execute arbitrary code.
Exploitation requires the GUI version of Vim with the menu bar enabled, and user interaction to browse or bookmark the crafted path so it is recorded in netrw history or bookmarks and the menus are rebuilt.
Remediation
Install update from vendor's website.