Out-of-bounds read in Vim - CVE-2026-57454

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to out-of-bounds read in text property handling when processing a crafted undo or swap file. A remote attacker can trick the victim into opening a crafted undo or swap file to disclose sensitive information or cause a denial of service.

User interaction is required to open a crafted undo or swap file.

Affected software

How to mitigate CVE-2026-57454

External References

• https://github.com/vim/vim/security/advisories/GHSA-ww8h-47xp-hp4w
• https://github.com/vim/vim/commit/b3faeecc976d3031d7c0675623516ec60c30f949

Related Security Bulletins

• Out-of-bounds read in Vim