Out-of-bounds read in Vim - CVE-2026-52859

Vulnerability identifier: #VU133141

CSH Severity: Medium

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-52859

CWE-ID: CWE-125

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the update_snapshot() function in src/terminal.c when processing terminal screen snapshots in a :terminal window. A local user can emit terminal output containing a cell with a base character and five combining marks to cause a denial of service.

The issue can be triggered when the user enters Terminal-Normal mode or when the terminal job exits.

Vim
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Ubuntu
openEuler
vim (Ubuntu package)
vim (Red Hat package)
vim-filesystem
vim-X11
vim-common
vim-enhanced
vim-minimal
vim-debuginfo
vim-debugsource
vim
vim-doc
vim-data

Install security update from vendor's website.

Vim - update to 9.2.0565
vim (Ubuntu package) - addressed in versions 2:7.4.052-1ubuntu3.1+esm29, 2:7.4.1689-3ubuntu1.5+esm35, 2:8.0.1453-1ubuntu1.13+esm20, 2:8.1.2269-1ubuntu5.32+esm8, 2:8.2.3995-1ubuntu2.32, 2:9.1.0016-1ubuntu7.16, 2:9.1.0967-1ubuntu6.7, 2:9.1.2141-1ubuntu4.5
vim (Red Hat package) - addressed in versions 8.0.1763-31.el8_10.7, 8.2.2637-26.el9_8.21, 9.1.083-9.el10_2.20
vim-filesystem - addressed in versions 8.0.1763-31.0.1, 9.0.2092-17
vim-X11 - addressed in versions 8.0.1763-31.0.1, 9.0.2092-17
vim-common - addressed in versions 8.0.1763-31.0.1, 9.0.2092-17
vim-enhanced - addressed in versions 8.0.1763-31.0.1, 9.0.2092-17
vim-minimal - addressed in versions 8.0.1763-31.0.1, 9.0.2092-17
vim-common - addressed in versions 9.0-50, 9.0.2092-36
vim-debuginfo - addressed in versions 9.0-50, 9.0.2092-36
vim-debugsource - addressed in versions 9.0-50, 9.0.2092-36
vim-enhanced - addressed in versions 9.0-50, 9.0.2092-36
vim-minimal - addressed in versions 9.0-50, 9.0.2092-36
vim-filesystem - addressed in versions 9.0-50, 9.0.2092-36
vim - addressed in versions 9.0-50, 9.0.2092-36
vim-X11 - addressed in versions 9.0-50, 9.0.2092-36
vim-doc - update to 9.0.2092-17
vim-data - update to 9.0.2092-17

• https://github.com/vim/vim/security/advisories/GHSA-47gw-8gc3-mgcm
• https://github.com/vim/vim/commit/63680c6d3d52477817b49cd1a66e7aabe8a7aa19

• Out-of-bounds read in Vim
• Ubuntu update for vim
• openEuler 24.03 LTS SP3 update for vim
• openEuler 24.03 LTS SP1 update for vim
• openEuler 22.03 LTS SP4 update for vim
• Anolis OS update for vim
• openEuler 20.03 LTS SP4 update for vim
• Red Hat Enterprise Linux 10 update for vim
• Red Hat Enterprise Linux 8 update for vim
• Red Hat Enterprise Linux 9 update for vim
• Anolis OS update for vim