Heap-based buffer overflow in Vim - CVE-2026-28418

Vulnerability identifier: #VU123424

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-28418

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the emacs_tags_new_filename() function in Emacs-style tags file parsing logic. A remote attacker can trick the victim into opening a specially crafted tags file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Vim
IBM Cloud Pak for Data System
Ubuntu
openEuler
Anolis OS
Fedora
vim (Ubuntu package)
vim-common
vim-X11
vim-enhanced
vim-minimal
vim-data
vim-doc
vim-filesystem
vim-debuginfo
vim-debugsource
vim

Install updates from vendor's website.

Vim - update to 9.2.0074
vim (Ubuntu package) - addressed in versions 2:7.4.052-1ubuntu3.1+esm23, 2:7.4.1689-3ubuntu1.5+esm29, 2:8.0.1453-1ubuntu1.13+esm14, 2:8.1.2269-1ubuntu5.32+esm2, 2:8.2.3995-1ubuntu2.26, 2:9.1.0016-1ubuntu7.10, 2:9.1.0967-1ubuntu6.1
vim-common - update to 9.0.2092-10
vim-X11 - update to 9.0.2092-10
vim-enhanced - update to 9.0.2092-10
vim-minimal - update to 9.0.2092-10
vim-data - update to 9.0.2092-10
vim-doc - update to 9.0.2092-10
vim-filesystem - update to 9.0.2092-10
vim-debuginfo - update to 9.0.2092-26
vim-filesystem - update to 9.0.2092-26
vim-minimal - update to 9.0.2092-26
vim-enhanced - update to 9.0.2092-26
vim-debugsource - update to 9.0.2092-26
vim-common - update to 9.0.2092-26
vim-X11 - update to 9.0.2092-26
vim - update to 9.0.2092-26
vim - addressed in versions 9.2.112-1.fc43, 9.2.112-1.fc44, 9.2.112-2.fc42, 9.2.112-2.fc43, 9.2.112-2.fc44, 9.2.148-1.fc42, 9.2.148-1.fc44

• https://github.com/vim/vim/security/advisories/GHSA-h4mf-vg97-hj8j
• https://github.com/vim/vim/commit/f6a7f469a9c0d09e84cd6cb

• Heap-based buffer overflow in Vim
• Anolis OS update for vim
• Fedora 44 update for vim
• Fedora 43 update for vim
• Fedora 44 update for vim
• Fedora 43 update for vim
• Fedora 42 update for vim
• Fedora 44 update for vim
• Fedora 42 update for vim
• openEuler update for vim
• Ubuntu update for vim
• Multiple vulnerabilities in IBM Cloud Pak for Data System