SB2026110159 - Debian update for vim
Published: November 1, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 40 vulnerabilities.
1) Out-of-bounds write (CVE-ID: CVE-2026-57455)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to out-of-bounds write in the single-byte branch of spell_soundfold_sofo() in src/spell.c when processing an over-long word through SOFO sound-folding. A local user can supply a specially crafted over-long word to cause a denial of service.
The vulnerable path is only reached under a non-multibyte 8-bit encoding such as latin1, with spell checking enabled for a language that uses a SOFO sound-folding table.
2) Code Injection (CVE-ID: CVE-2026-47162)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper control of code generation in s:NetrwBookHistSave() in the netrw plugin when serializing browsed directory paths to the history file. A remote attacker can create a specially crafted directory name to execute arbitrary code.
User interaction is required to browse the crafted directory with netrw and later open any directory so the history file is sourced. The injected content persists in the history file until the entry is rotated out.
3) Eval Injection (CVE-ID: CVE-2026-47167)
CWE-ID: CWE-95 - Eval Injection
CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper neutralization of directives in dynamically evaluated code in s:stepmatch() in the cucumber filetype plugin when processing crafted step-definition regex patterns from repository .rb files during step-jump handling. A remote attacker can place a specially crafted step-definition pattern in an attacker-controlled repository to execute arbitrary code.
Exploitation requires a Vim build with +ruby support and user interaction to invoke a step-jump mapping on a matching feature line.
4) Code Injection (CVE-ID: CVE-2026-52858)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to improper control of code generation in python omni-completion in python3complete.vim when processing a crafted Python file during omni-completion. A local user can place a crafted Python file with attacker-controlled import statements and a sibling package in the working directory to execute arbitrary code.
User interaction is required to invoke omni-completion with CTRL-X CTRL-O while editing the crafted Python file, and the issue affects builds with the Python interpreter enabled and filetype plugins active.
5) Out-of-bounds read (CVE-ID: CVE-2026-52859)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to out-of-bounds read in the update_snapshot() function in src/terminal.c when processing terminal screen snapshots in a :terminal window. A local user can emit terminal output containing a cell with a base character and five combining marks to cause a denial of service.
The issue can be triggered when the user enters Terminal-Normal mode or when the terminal job exits.
6) Code Injection (CVE-ID: CVE-2026-52860)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to improper control of code generation in Python omni-completion in runtime/autoload/python3complete.vim and pythoncomplete.vim when reconstructing and executing function and class definitions from a hostile Python buffer during omni-completion. A local user can trick the victim into opening or editing a crafted Python buffer and triggering omni-completion to execute arbitrary code.
Only builds with +python3 or +python are affected, and triggering omni-completion in the hostile buffer is required.
7) Out-of-bounds write (CVE-ID: CVE-2026-55693)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds write in the tree_count_words() function in src/spellfile.c when parsing a crafted .spl/.sug spell file pair during spell suggestion loading. A remote attacker can supply a specially crafted spell file pair to cause a denial of service.
User interaction is required: spell checking must be enabled and the user must invoke spell suggestion on a misspelled word.
8) Out-of-bounds write (CVE-ID: CVE-2026-55892)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds write in the dump_prefixes() function in src/spell.c when parsing a crafted .spl spell file during word list dumping. A remote attacker can supply a crafted spell file to cause a denial of service.
User interaction is required: spell checking must be enabled and the user must dump the word list, such as via :spelldump or spelling completion.
9) Code Injection (CVE-ID: CVE-2026-55895)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper control of code generation in s:NetrwLocalRmFile() in the netrw plugin when deleting a local file from the browser using a crafted filename from the directory listing. A remote attacker can place a file with a crafted name containing Ex command separators and trick the victim into deleting that entry to execute arbitrary code.
User interaction is required to delete the specific crafted file entry, and exploitation is limited to environments where filenames may contain the bar character.
10) Out-of-bounds read (CVE-ID: CVE-2026-57452)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds read in crypt_sodium_buffer_decode() when parsing a crafted libsodium-encrypted file. A remote attacker can trick the victim into opening a crafted file and entering a key to cause a denial of service.
Only instances built with the +sodium feature are vulnerable, and the issue affects files using the VimCrypt~04! or VimCrypt~05! encryption method.
11) OS Command Injection (CVE-ID: CVE-2026-46483)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary shell commands.
The vulnerability exists due to improper neutralization of special elements in tar#Vimuntar() in runtime/autoload/tar.vim when decompressing .tgz archives via :Vimuntar on Unix-like systems. A remote attacker can supply a crafted archive filename to execute arbitrary shell commands.
User interaction is required to open the crafted file and invoke the non-routine :Vimuntar command, and only Unix-like systems with the tar plugin enabled are vulnerable.
12) Code Injection (CVE-ID: CVE-2026-57456)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper control of code generation in Python omni-completion docstring handling in runtime/autoload/python3complete.vim and pythoncomplete.vim when processing a hostile Python buffer during omni-completion. A remote attacker can craft a malicious docstring and convince a user to trigger Python omni-completion to execute arbitrary code.
User interaction is required to open or edit a hostile Python buffer and trigger Python omni-completion. Only builds with +python3 or +python support are affected.
13) Code Injection (CVE-ID: CVE-2026-59856)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper control of code generation in runtime/autoload/phpcomplete.vim when processing a crafted PHP file during omni-completion. A remote attacker can trick the victim into opening a crafted file and invoking omni-completion to execute arbitrary code.
User interaction is required to open a crafted PHP file and manually invoke omni-completion, and exploitation requires filetype plugins to be enabled.
14) Out-of-bounds write (CVE-ID: CVE-2026-59857)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to out-of-bounds write in the SAL sound-folding logic in spell_soundfold_sal() when processing a boundary-length word through soundfold() with a SAL-based spell language active. A local user can supply a crafted boundary-length word to cause a denial of service.
The vulnerable path is only reached under a non-multibyte 8-bit encoding such as latin1, and spell checking must be enabled with a SAL-based language.
15) Code Injection (CVE-ID: CVE-2026-59858)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to improper neutralization of special elements in the C omni-completion script in runtime/autoload/ccomplete.vim when processing type information from a tags entry during omni-completion. A local user can supply a crafted tags entry and trick the victim into invoking C omni-completion on a hostile .c file to execute arbitrary code.
User interaction is required to open a hostile .c file and invoke omni-completion on a structure-member access, and the issue is reachable only when filetype plugins are enabled and a reachable tags file is used.
16) Heap-based buffer overflow (CVE-ID: CVE-2026-73072)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error. A remote attacker can trick a victim to open a specially crafted spell file, trigger a heap-based buffer overflow and cause a denial of service on the target system.
17) Code Injection (CVE-ID: CVE-2026-73073)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation within the C omni-completion script in runtime/autoload/ccomplete.vim. A remote attacker can trick a victim to open a specially crafted file and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
18) Code Injection (CVE-ID: CVE-2026-73076)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation within the Vimball record file. A remote attacker can execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
19) OS Command Injection (CVE-ID: CVE-2026-73077)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to command injection in the shell filetype plugins when processing a crafted Visual mode selection through keyword lookup with K. A remote attacker can trick the victim into opening a crafted file, selecting a crafted line, and invoking keyword lookup to execute arbitrary code.
User interaction is required to select the crafted text in Visual mode and invoke K, and the issue affects buffers whose filetype resolves to sh, bash, zsh, or PowerShell with filetype plugins enabled.
20) Command injection (CVE-ID: CVE-2026-73078)
CWE-ID: CWE-77 - Command injection
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to command injection in netrw menu construction in runtime/pack/dist/opt/netrw/autoload/netrw.vim when rebuilding bookmarks, history, and targets menus from attacker-controlled directory paths. A remote attacker can supply a specially crafted directory path containing command separators or quotes to execute arbitrary code.
Exploitation requires the GUI version of Vim with the menu bar enabled, and user interaction to browse or bookmark the crafted path so it is recorded in netrw history or bookmarks and the menus are rebuilt.
21) NULL pointer dereference (CVE-ID: CVE-2026-32249)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error within the nfa_max_width() function when the NFA regex engine processes a look-behind assertion containing a collection with a combining Unicode character as a range endpoint. A remote attacker can trick the victim into opening a specially crafted file and crash the application.
22) Path traversal (CVE-ID: CVE-2025-53906)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to input validation error when processing directory traversal sequences in zip.vim plugin. A remote attacker can trick the victim into opening a specially crafted archive and overwrite arbitrary files on the system, leading to remote code execution.
23) Heap-based buffer overflow (CVE-ID: CVE-2026-25749)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the get_tagfname() function in src/tag.c. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
24) Stack-based buffer overflow (CVE-ID: CVE-2026-26269)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the special_keys() function in src/netbeans.c. A remote attacker can trick the victim into opening a specially crafted file that initiates connection with attacker-controlled NetBeans server, trigger a stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
25) OS command injection (CVE-ID: CVE-2026-28417)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation within the netrw standard plugin bundled with Vim. A remote attacker can trick the victim into opening a specially crafted scp:// URL and execute arbitrary OS commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
26) Heap-based buffer overflow (CVE-ID: CVE-2026-28418)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the emacs_tags_new_filename() function in Emacs-style tags file parsing logic. A remote attacker can trick the victim into opening a specially crafted tags file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
27) Heap-based buffer overflow (CVE-ID: CVE-2026-28419)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the emacs_tags_parse_line() function in src/tag.c in Emacs-style tags file parsing logic. A remote attacker can trick the victim into opening a specially crafted tags file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
28) Heap-based buffer overflow (CVE-ID: CVE-2026-28420)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 7.4 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the handle_pushline() function in src/terminal.c processing maximum combining characters from Unicode supplementary planes. A remote attacker can trick the victim into copying a specially crafted string into the :terminal buffer, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
29) Heap-based buffer overflow (CVE-ID: CVE-2026-28421)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in swap file recovery logic. A remote attacker can trick the victim into opening a specially crafted swap file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
30) Stack-based buffer overflow (CVE-ID: CVE-2026-28422)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the build_stl_str_hl() function. A remote unauthenticated attacker can trick the victim into opening a specially crafted file, trigger stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
31) Path traversal (CVE-ID: CVE-2025-53905)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to input validation error when processing directory traversal sequences in tar.vim plugin. A remote attacker can trick the victim into opening a specially crafted archive and overwrite arbitrary files on the system, leading to remote code execution.
32) OS Command Injection (CVE-ID: CVE-2026-33412)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation in the "glob()" function. A remote user can pass specially crafted data to the application and execute arbitrary OS commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
33) OS Command Injection (CVE-ID: CVE-2026-34982)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary OS commands.
The vulnerability exists due to improper neutralization of special elements used in an OS command in modeline processing for the complete, guitabtooltip, and printheader options and the mapset() function when opening a crafted file. A remote attacker can deliver a specially crafted file to execute arbitrary OS commands.
User interaction is required to open a crafted file.
34) Path traversal (CVE-ID: CVE-2026-35177)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to overwrite arbitrary files.
The vulnerability exists due to path traversal in zip.vim when processing specially crafted zip archives. A remote attacker can trick the victim into opening a crafted archive and editing a malicious file within it to overwrite arbitrary files.
User interaction is required, and the file is written when the victim attempts to save it using :w.
35) OS Command Injection (CVE-ID: CVE-2026-39881)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: 5.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation in NetBeans integration. A remote user can pass specially crafted data to the application and execute arbitrary OS commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
36) OS Command Injection (CVE-ID: CVE-2026-41411)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary shell commands.
The vulnerability exists due to improper neutralization of special elements used in an os command in tag file processing when resolving tag filenames from a tags file. A remote attacker can place a specially crafted tags file entry containing backtick syntax and trigger tag navigation to execute arbitrary shell commands.
User interaction is required to perform tag navigation such as :tag, Ctrl-], or vim -t after opening Vim in a directory containing a malicious tags file.
37) OS Command Injection (CVE-ID: CVE-2026-42307)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary shell commands.
The vulnerability exists due to improper neutralization of special elements used in an OS command in the netrw standard plugin function s:GetTempfile() when processing crafted local or remote URLs. A remote attacker can trick the victim into opening a crafted URL to execute arbitrary shell commands.
User interaction is required to open a crafted URL, and the injected payload is typically visible in the filename.
38) Code Injection (CVE-ID: CVE-2026-43961)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary Vimscript and shell commands.
The vulnerability exists due to improper control of generation of code in s:NetrwMarkFile() in the netrw plugin when unmarking files from the global marked-file list. A local user can create a crafted filename containing a double quote and induce the victim to mark and unmark that entry to execute arbitrary Vimscript and shell commands.
User interaction is required, and the issue only triggers on the second mf press for a given entry. Exploitation requires a Unix-like system on which filenames may contain a double quote.
39) OS Command Injection (CVE-ID: CVE-2026-44656)
CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary shell commands.
The vulnerability exists due to command injection in the :find command-line completion path when processing a file with a modeline that sets the 'path' option to include backtick-enclosed shell commands and the user triggers file name completion. A remote attacker can supply a crafted file to execute arbitrary shell commands.
User interaction is required to open the crafted file and trigger completion, and exploitation via modeline requires the 'modeline' feature to be enabled.
40) Heap-based buffer overflow (CVE-ID: CVE-2026-45130)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to heap-based buffer overflow in read_compound() in src/spellfile.c when loading a crafted .spl spell file with UTF-8 encoding active. A remote attacker can trick the victim into opening a text file with a crafted modeline or otherwise cause Vim to load a planted spell file to cause a denial of service.
User interaction is required, and exploitation requires a malicious .spl file to be present on the runtimepath while UTF-8 encoding is active.
Remediation
Install update from vendor's website.