SB2026103112 - Ubuntu update for vim
Published: October 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 vulnerabilities.
1) OS command injection (CVE-ID: CVE-2026-28417)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation within the netrw standard plugin bundled with Vim. A remote attacker can trick the victim into opening a specially crafted scp:// URL and execute arbitrary OS commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
2) Use-after-free (CVE-ID: CVE-2026-73071)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in JSON decoding. A local user can perform a denial of service (DoS) attack on the system.
3) Heap-based buffer overflow (CVE-ID: CVE-2026-73072)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error. A remote attacker can trick a victim to open a specially crafted spell file, trigger a heap-based buffer overflow and cause a denial of service on the target system.
4) Heap-based buffer overflow (CVE-ID: CVE-2026-73074)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to crash the application.
The vulnerability exists due to an integer overflow leading to a heap-based buffer overflow in prop_add_one() in src/textprop.c when adding text properties to a single line. A remote attacker can add a large number of crafted text properties to trigger an out-of-bounds heap write and to cause a denial of service and potentially execute arbitrary code.
Exploitation requires Vim to be built with the textprop feature and requires a script or plugin path that causes 65536 text properties to be added to a single line, such as processing attacker-controlled file contents through a plugin.
5) Code Injection (CVE-ID: CVE-2026-73076)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation within the Vimball record file. A remote attacker can execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
6) OS Command Injection (CVE-ID: CVE-2026-73077)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to command injection in the shell filetype plugins when processing a crafted Visual mode selection through keyword lookup with K. A remote attacker can trick the victim into opening a crafted file, selecting a crafted line, and invoking keyword lookup to execute arbitrary code.
User interaction is required to select the crafted text in Visual mode and invoke K, and the issue affects buffers whose filetype resolves to sh, bash, zsh, or PowerShell with filetype plugins enabled.
7) Command injection (CVE-ID: CVE-2026-73078)
CWE-ID: CWE-77 - Command injection
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to command injection in netrw menu construction in runtime/pack/dist/opt/netrw/autoload/netrw.vim when rebuilding bookmarks, history, and targets menus from attacker-controlled directory paths. A remote attacker can supply a specially crafted directory path containing command separators or quotes to execute arbitrary code.
Exploitation requires the GUI version of Vim with the menu bar enabled, and user interaction to browse or bookmark the crafted path so it is recorded in netrw history or bookmarks and the menus are rebuilt.
Remediation
Install update from vendor's website.