CVE-2026-25749

Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been patched in version 9.1.2132.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been patched in version 9.1.2132.(CVE-2026-25749)

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Arbitrary code execution via 'helpfile' option processing (CVE-2026-25749)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Arbitrary code execution via 'helpfile' option processing (CVE-2026-25749)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Arbitrary code execution via 'helpfile' option processing (CVE-2026-25749)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been patched in version 9.1.2132.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Arbitrary code execution via 'helpfile' option processing (CVE-2026-25749)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Arbitrary code execution via 'helpfile' option processing (CVE-2026-25749)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Arbitrary code execution via 'helpfile' option processing (CVE-2026-25749)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been patched in version 9.1.2132.

Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow vulnerability exists in Vim's tag file resolution logic when processing the 'helpfile' option. The vulnerability is located in the get_tagfname() function in src/tag.c. When processing help file tags, Vim copies the user-controlled 'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1 bytes (typically 4097 bytes) using an unsafe STRCPY() operation without any bounds checking. This issue has been patched in version 9.1.2132.

• SECURITY UPDATE: Heap buffer overflow in helpfile option handling
  • debian/patches/CVE-2026-25749.patch: use vim_strncpy with MAXPATHL bound instead of unbounded STRCPY in get_tagfname()
  • CVE-2026-25749

• CVE-2026-25749: fix buffer overflow in 'helpfile' option handling in get_tagfname()

• CVE-2026-25749: fix buffer overflow in 'helpfile' option handling in get_tagfname()

• SECURITY UPDATE: Heap buffer overflow in get_tagfname() in src/tag.c: the user-settable 'helpfile' option value is copied into a fixed MAXPATHL+1-sized heap buffer with an unbounded STRCPY() when help-file tags are resolved, so a 'helpfile' path longer than MAXPATHL writes past the end of the buffer
  • debian/patches/CVE-2026-25749.patch: replace the unbounded STRCPY(buf, p_hf) in get_tagfname() with a bounded vim_strncpy() that also leaves room for the "tags" tail appended by the following STRCPY(gettail(buf), "tags"), so the 'helpfile' value can no longer be copied past the end of the caller's MAXPATHL-sized buffer
  • CVE-2026-25749
• SECURITY UPDATE: Modeline sandbox bypass allowing arbitrary OS command execution when a crafted file is opened: the 'complete', 'guitabtooltip' and 'printheader' options are missing the P_MLE flag, so a modeline can set them to expressions that are evaluated outside the 'modelineexpr' guard
  • debian/patches/CVE-2026-34982.patch: add the P_MLE flag to the 'complete', 'guitabtooltip' and 'printheader' entries of the option table in src/option.c so a modeline can no longer set them while 'modelineexpr' is off; the upstream mapset() hunk is dropped as mapset() does not exist in 8.1.0875
  • CVE-2026-34982
• SECURITY UPDATE: Command injection during tag resolution in expand_tag_fname() in src/tag.c: the filename field read from a tags file is passed to ExpandOne() for wildcard and environment-variable expansion, so a crafted tags file containing backtick syntax makes vim execute the embedded command through the shell with the user's privileges
  • debian/patches/CVE-2026-41411.patch: guard the wildcard expansion in expand_tag_fname() with vim_strchr(fname, '`') == NULL so a tags-file filename field containing backticks is never handed to ExpandOne() and can no longer reach the shell
  • CVE-2026-41411

• CVE-2026-25749: bound the copy of the 'helpfile' option value in get_tagfname() so an over-long value cannot overflow the MAXPATHL buffer, reserving room for the "tags" tail appended right after (upstream 9.1.2132)

• SECURITY UPDATE: stack-based buffer overflow in option callback functions: illegal_char() and did_set_string_option() wrote the E539/E526/E535 option errors into the caller's 80-byte errbuf[] with unbounded sprintf(). The call site reported upstream, did_set_langmap() in src/map.c, does not exist in this version, where 'langmap' errors are reported through EMSG2() into a bounded buffer.
  • debian/patches/CVE-2024-22667.patch: introduce ERR_BUFLEN and use snprintf() bounded by it at the three sprintf() sites, in src/option.c and src/option.h; matches upstream patch 9.0.2142.
  • CVE-2024-22667
• SECURITY UPDATE: buffer overflow in 'helpfile' option handling: get_tagfname() copied the user-controlled 'helpfile' value into a MAXPATHL buffer with STRCPY() and then appended "tags" at the tail, so an over-long 'helpfile' overflowed the buffer.
  • debian/patches/CVE-2026-25749.patch: bound the copy with vim_strncpy() leaving room for the "tags" suffix, in src/tag.c; matches upstream patches 9.1.2132 and 9.1.2133.
  • CVE-2026-25749
• SECURITY UPDATE: buffer overflow in the netbeans specialKeys command: special_keys() walked the modifier prefix writing two bytes per modifier into the 64-byte keybuf[] with no bound, so a long modifier run overflowed it.
  • debian/patches/CVE-2026-26269.patch: stop the modifier loop while i + 2 < KEYBUFLEN, in src/netbeans.c; matches upstream patch 9.1.2148.
  • CVE-2026-26269
• SECURITY UPDATE: command injection via netrw URIs: the hostname and port taken from a netrw URI were interpolated unescaped into the command passed to system(), so shell metacharacters in the host or port ran arbitrary commands.
  • debian/patches/CVE-2026-28417.patch: validate the host against an RFC1123 hostname / IPv4 / IPv6 pattern at the four netrw entry points and shellescape() the host, user and port in s:MakeSshCmd(), in runtime/autoload/netrw.vim; matches upstream patches 9.2.0073, 9.2.0089 and 9.2.0553.
  • CVE-2026-28417
• SECURITY UPDATE: crash and huge allocation recovering a corrupted swap file: ml_recover() trusted pe_page_count, pe_bnum, pe_old_lnum and pe_line_count from the swap file, so bogus values caused a multi-GB mf_get() allocation or a SEGV inside readfile().
  • debian/patches/CVE-2026-28421.patch: bound pe_page_count and pe_bnum against mf_blocknr_max and validate pe_old_lnum and pe_line_count before use, in src/memline.c; matches upstream patch 9.2.0077.
  • CVE-2026-28421
• SECURITY UPDATE: command injection via newline in glob(): the newline character was missing from SHELL_SPECIAL, so it was not escaped before mch_expand_wildcards() handed the pattern to the shell and could act as a command separator.
  • debian/patches/CVE-2026-33412.patch: add '\n' to SHELL_SPECIAL, in src/os_unix.c; matches upstream patch 9.2.0202.
  • CVE-2026-33412
• SECURITY UPDATE: modeline security bypass: several options holding expressions could be set from a modeline, so opening a crafted file evaluated attacker-supplied expressions. In this version the expressions reachable this way are the 'statusline'-style %{} items of 'printheader' and 'guitabtooltip', which were evaluated in the sandbox only; the F{func} flag of 'complete' and the mapset() function named by the upstream advisory arrived in later releases and are not present in this version.
  • debian/patches/patch-8.1.1366-using-expressions-in-a-modeline-is-unsafe.patch: add the 'modelineexpr' option and the P_MLE flag, refuse P_MLE options in a modeline unless 'modelineexpr' is set, mark the expression-bearing options P_MLE, and document 'modelineexpr' and E992, in src/option.c, src/option.h and runtime/doc/options.txt; prerequisite…

Rahul Hoysala discovered that Vim did not correctly handle certain tag resolutions. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-25749)

It was discovered that Vim did not correctly handle processing certain specialKey commands. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-26269)

Kim Dong Han discovered that Vim did not correctly handle opening certain URLs. If a user or system were tricked into opening a specially crafted file, an attacker could possibly use this issue to execute arbitrary code. (CVE-2026-28417)

Kim Dong Han discovered that Vim did not correctly handle parsing Emacs-style tag files. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-28418, CVE-2026-28419)

Kim Dong Han discovered that Vim did not correctly handle processing maximum combining characters from Unicode supplementary planes. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2026-28420)

Kim Dong Han discovered that Vim did not correctly handle swap file recovery. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-28421)

Kim Dong Han discovered that Vim did not correctly handle rendering status lines. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-28422)