NULL pointer dereference in Vim - CVE-2026-32249
Published: March 30, 2026
Vulnerability identifier: #VU124677
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-32249
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error within the nfa_max_width() function when the NFA regex engine processes a look-behind assertion containing a collection with a combining Unicode character as a range endpoint. A remote attacker can trick the victim into opening a specially crafted file and crash the application.
Affected software
Vim
Ubuntu
vim (Ubuntu package)
Ubuntu
vim (Ubuntu package)
How to mitigate CVE-2026-32249
Install updates from vendor's website.
Vim - update to 9.2.0137
vim (Ubuntu package) - addressed in versions 2:7.4.052-1ubuntu3.1+esm24, 2:7.4.1689-3ubuntu1.5+esm30, 2:8.0.1453-1ubuntu1.13+esm15, 2:8.1.2269-1ubuntu5.32+esm3, 2:8.2.3995-1ubuntu2.27, 2:9.1.0016-1ubuntu7.11, 2:9.1.0967-1ubuntu6.2
vim (Ubuntu package) - addressed in versions 2:7.4.052-1ubuntu3.1+esm24, 2:7.4.1689-3ubuntu1.5+esm30, 2:8.0.1453-1ubuntu1.13+esm15, 2:8.1.2269-1ubuntu5.32+esm3, 2:8.2.3995-1ubuntu2.27, 2:9.1.0016-1ubuntu7.11, 2:9.1.0967-1ubuntu6.2