OS Command Injection in Vim - CVE-2026-34714

Vulnerability identifier: #VU143641

CSH Severity: Low

CVSS v4: 6.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L]

CVE-ID: CVE-2026-34714

CWE-ID: CWE-78

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to execute arbitrary shell commands on the target system.

The vulnerability exists due to %{expr} injection occurs with tabpanel lacking P_MLE. A local user can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Vim
Dell Enterprise SONiC Distribution
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
Desktop Applications Module
Basesystem Module
openSUSE Leap
Fedora
vim
gvim
vim-data-common
vim-data
vim-debuginfo
vim-debugsource
gvim-debuginfo
vim-small-debuginfo
vim-small

Install updates from vendor's website.

Vim - update to 9.2.0272
Dell Enterprise SONiC Distribution - update to 4.6.0
vim - addressed in versions 9.2.272-1.fc43, 9.2.272-1.fc44, 9.2.280-1.fc42, 9.2.280-1.fc43
gvim - addressed in versions 9.2.0280-17.62.1, 9.2.0280-150000.5.89.1, 9.2.0280-150500.20.46.1
vim-data-common - addressed in versions 9.2.0280-17.62.1, 9.2.0280-150000.5.89.1, 9.2.0280-150500.20.46.1
vim-data - addressed in versions 9.2.0280-17.62.1, 9.2.0280-150000.5.89.1, 9.2.0280-150500.20.46.1
vim-debuginfo - addressed in versions 9.2.0280-17.62.1, 9.2.0280-150000.5.89.1, 9.2.0280-150500.20.46.1
vim-debugsource - addressed in versions 9.2.0280-17.62.1, 9.2.0280-150000.5.89.1, 9.2.0280-150500.20.46.1
vim - addressed in versions 9.2.0280-17.62.1, 9.2.0280-150000.5.89.1, 9.2.0280-150500.20.46.1
gvim-debuginfo - addressed in versions 9.2.0280-17.62.1, 9.2.0280-150000.5.89.1, 9.2.0280-150500.20.46.1
vim-small-debuginfo - addressed in versions 9.2.0280-150000.5.89.1, 9.2.0280-150500.20.46.1
vim-small - addressed in versions 9.2.0280-150000.5.89.1, 9.2.0280-150500.20.46.1

• https://github.com/vim/vim/commit/664701eb7576edb7c7c7d9f2d600815ec1f43459
• https://github.com/vim/vim/releases/tag/v9.2.0272
• https://github.com/vim/vim/security/advisories/GHSA-2gmj-rpqf-pxvh
• https://www.openwall.com/lists/oss-security/2026/03/30/3
• http://www.openwall.com/lists/oss-security/2026/04/02/4
• http://www.openwall.com/lists/oss-security/2026/04/02/5
• http://www.openwall.com/lists/oss-security/2026/04/03/6
• https://access.redhat.com/security/cve/CVE-2026-34714
• https://bugzilla.redhat.com/show_bug.cgi?id=2453139
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34714.json

• OS Command Injection in Vim
• Multiple vulnerabilities in Dell Enterprise SONiC Distribution
• Fedora 44 update for vim
• Fedora 43 update for vim
• Fedora 43 update for vim
• Fedora 42 update for vim
• SUSE update for vim
• SUSE update for vim
• SUSE update for vim