CVE-2026-28421

Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) exist in Vim's swap file recovery logic. Both are caused by unvalidated fields read from crafted pointer blocks within a swap file. Version 9.2.0077 fixes the issue.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the scp:// protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.(CVE-2026-28417)

Vim is an open source, command line text editor. Prior to version 9.2.0074, a heap-based buffer overflow out-of-bounds read exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file, Vim can be tricked into reading up to 7 bytes beyond the allocated memory boundary. Version 9.2.0074 fixes the issue.(CVE-2026-28418)

Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a delimiter appears at the start of a line, Vim attempts to read memory immediately preceding the allocated buffer. Version 9.2.0075 fixes the issue.(CVE-2026-28419)

Vim is an open source, command line text editor. Prior to version 9.2.0076, a heap-based buffer overflow WRITE and an out-of-bounds READ exist in Vim's terminal emulator when processing maximum combining characters from Unicode supplementary planes. Version 9.2.0076 fixes the issue.(CVE-2026-28420)

Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) exist in Vim's swap file recovery logic. Both are caused by unvalidated fields read from crafted pointer blocks within a swap file. Version 9.2.0077 fixes the issue.(CVE-2026-28421)

Vim is an open-source, command-line text editor. Prior to version 9.2.0078, a stack-buffer-overflow occurs in the build_stl_str_hl() function when rendering a statusline with a multi-byte fill character on a very wide terminal. This vulnerability may lead to application crash or potential security risks.(CVE-2026-28422)

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin (CVE-2026-28417)

• vim: Vim: Denial of service and information disclosure via crafted swap file (CVE-2026-28421)

• vim: Vim: Arbitrary code execution via command injection in glob() function (CVE-2026-33412)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin (CVE-2026-28417)

• vim: Vim: Denial of service and information disclosure via crafted swap file (CVE-2026-28421)

• vim: Vim: Arbitrary code execution via command injection in glob() function (CVE-2026-33412)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin (CVE-2026-28417)

• vim: Vim: Denial of service and information disclosure via crafted swap file (CVE-2026-28421)

• vim: Vim: Arbitrary code execution via command injection in glob() function (CVE-2026-33412)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2026-28421 in the vim package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-28421 in the vim package for Root:Debian:12. Multiple fixed versions available.

Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) exist in Vim's swap file recovery logic. Both are caused by unvalidated fields read from crafted pointer blocks within a swap file. Version 9.2.0077 fixes the issue.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin (CVE-2026-28417)
• vim: Vim: Denial of service and information disclosure via crafted swap file (CVE-2026-28421)
• vim: Vim: Arbitrary code execution via command injection in glob() function (CVE-2026-33412)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin (CVE-2026-28417)
• vim: Vim: Denial of service and information disclosure via crafted swap file (CVE-2026-28421)
• vim: Vim: Arbitrary code execution via command injection in glob() function (CVE-2026-33412)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim (Vi IMproved) is an updated and improved version of the vi editor.

Security Fix(es):

• vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin (CVE-2026-28417)
• vim: Vim: Denial of service and information disclosure via crafted swap file (CVE-2026-28421)
• vim: Vim: Arbitrary code execution via command injection in glob() function (CVE-2026-33412)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) exist in Vim's swap file recovery logic. Both are caused by unvalidated fields read from crafted pointer blocks within a swap file. Version 9.2.0077 fixes the issue.

• CVE-2026-28417: fix OS command injection in netrw plugin via crafted scp:// URIs by adding strict RFC1123 hostname validation and using shellescape() for hostname and port values.
• CVE-2026-28421: fix heap-buffer-overflow and SEGV in swap file recovery by adding bounds checks on pe_page_count, pe_bnum, pe_old_lnum and pe_line_count before descending into the block tree.

• CVE-2026-28417: fix OS command injection via shell metacharacters in netrw URI hostname and port
• CVE-2026-28421: fix heap-buffer-overflow and SEGV in swap file recovery due to unvalidated pointer block fields

• CVE-2026-28417: fix OS command injection via shell metacharacters in netrw URI hostname and port
• CVE-2026-28421: fix heap-buffer-overflow and SEGV in swap file recovery due to unvalidated pointer block fields

• CVE-2026-28417: fix OS command injection in netrw plugin when handling specially crafted URLs such as scp://
• CVE-2026-28421: fix heap-buffer-overflow and crash when recovering from a maliciously crafted Vim swap file

• CVE-2026-28417: fix OS command injection in netrw plugin when handling specially crafted URLs such as scp://
• CVE-2026-28421: fix heap-buffer-overflow and crash when recovering from a maliciously crafted Vim swap file

• CVE-2026-28417: fix OS command injection in netrw plugin via crafted scp:// URIs by adding strict RFC1123 hostname validation and using shellescape() for hostname and port values.
• CVE-2026-28421: fix heap-buffer-overflow and SEGV in swap file recovery by adding bounds checks on pe_page_count, pe_bnum, pe_old_lnum and pe_line_count before descending into the block tree.

• SECURITY UPDATE: Crash when recovering a corrupted swap file
  • debian/patches/CVE-2026-28421.patch: add bounds checks in swap file recovery to prevent heap-buffer-overflow and SEGV from crafted swap files
  • CVE-2026-28421
• SECURITY UPDATE: Command injection via crafted netrw URIs
  • debian/patches/CVE-2026-28417.patch: fix command injection in netrw via crafted scp:// URIs by adding strict hostname validation and shellescape()
  • CVE-2026-28417

• SECURITY UPDATE: stack-based buffer overflow in option callback functions: illegal_char() and did_set_string_option() wrote the E539/E526/E535 option errors into the caller's 80-byte errbuf[] with unbounded sprintf(). The call site reported upstream, did_set_langmap() in src/map.c, does not exist in this version, where 'langmap' errors are reported through EMSG2() into a bounded buffer.
  • debian/patches/CVE-2024-22667.patch: introduce ERR_BUFLEN and use snprintf() bounded by it at the three sprintf() sites, in src/option.c and src/option.h; matches upstream patch 9.0.2142.
  • CVE-2024-22667
• SECURITY UPDATE: buffer overflow in 'helpfile' option handling: get_tagfname() copied the user-controlled 'helpfile' value into a MAXPATHL buffer with STRCPY() and then appended "tags" at the tail, so an over-long 'helpfile' overflowed the buffer.
  • debian/patches/CVE-2026-25749.patch: bound the copy with vim_strncpy() leaving room for the "tags" suffix, in src/tag.c; matches upstream patches 9.1.2132 and 9.1.2133.
  • CVE-2026-25749
• SECURITY UPDATE: buffer overflow in the netbeans specialKeys command: special_keys() walked the modifier prefix writing two bytes per modifier into the 64-byte keybuf[] with no bound, so a long modifier run overflowed it.
  • debian/patches/CVE-2026-26269.patch: stop the modifier loop while i + 2 < KEYBUFLEN, in src/netbeans.c; matches upstream patch 9.1.2148.
  • CVE-2026-26269
• SECURITY UPDATE: command injection via netrw URIs: the hostname and port taken from a netrw URI were interpolated unescaped into the command passed to system(), so shell metacharacters in the host or port ran arbitrary commands.
  • debian/patches/CVE-2026-28417.patch: validate the host against an RFC1123 hostname / IPv4 / IPv6 pattern at the four netrw entry points and shellescape() the host, user and port in s:MakeSshCmd(), in runtime/autoload/netrw.vim; matches upstream patches 9.2.0073, 9.2.0089 and 9.2.0553.
  • CVE-2026-28417
• SECURITY UPDATE: crash and huge allocation recovering a corrupted swap file: ml_recover() trusted pe_page_count, pe_bnum, pe_old_lnum and pe_line_count from the swap file, so bogus values caused a multi-GB mf_get() allocation or a SEGV inside readfile().
  • debian/patches/CVE-2026-28421.patch: bound pe_page_count and pe_bnum against mf_blocknr_max and validate pe_old_lnum and pe_line_count before use, in src/memline.c; matches upstream patch 9.2.0077.
  • CVE-2026-28421
• SECURITY UPDATE: command injection via newline in glob(): the newline character was missing from SHELL_SPECIAL, so it was not escaped before mch_expand_wildcards() handed the pattern to the shell and could act as a command separator.
  • debian/patches/CVE-2026-33412.patch: add '\n' to SHELL_SPECIAL, in src/os_unix.c; matches upstream patch 9.2.0202.
  • CVE-2026-33412
• SECURITY UPDATE: modeline security bypass: several options holding expressions could be set from a modeline, so opening a crafted file evaluated attacker-supplied expressions. In this version the expressions reachable this way are the 'statusline'-style %{} items of 'printheader' and 'guitabtooltip', which were evaluated in the sandbox only; the F{func} flag of 'complete' and the mapset() function named by the upstream advisory arrived in later releases and are not present in this version.
  • debian/patches/patch-8.1.1366-using-expressions-in-a-modeline-is-unsafe.patch: add the 'modelineexpr' option and the P_MLE flag, refuse P_MLE options in a modeline unless 'modelineexpr' is set, mark the expression-bearing options P_MLE, and document 'modelineexpr' and E992, in src/option.c, src/option.h and runtime/doc/options.txt; prerequisite…

OS Command Injection in netrw affects Vim < 9.2.0073. (CVE-2026-28417) Heap-based Buffer Overflow in Emacs tags parsing affects Vim < 9.2.0074. (CVE-2026-28418) Heap-based Buffer Underflow in Emacs tags parsing affects Vim < 9.2.0075. (CVE-2026-28419) Heap-based Buffer Overflow and OOB Read in :terminal affects Vim < 9.2.0076. (CVE-2026-28420) Multiple Vulnerabilities in Swap File Recovery affect Vim < 9.2.0077. (CVE-2026-28421) Stack-buffer-overflow in build_stl_str_hl() affects Vim < 9.2.0078. (CVE-2026-28422)

This update for vim fixes the following issues:

Update Vim to version 9.2.0110:

• CVE-2025-53906: Fixed that malicious zip archive may cause a path traversal in Vim's zip (bsc#1246602).
• CVE-2026-26269: Fixed Netbeans specialKeys stack buffer overflow (bsc#1258229).
• CVE-2026-28417: Fixed that a crafted URL parsed by netrw plugin can lead to execute arbitrary shell commands (bsc#1259051).
• CVE-2026-28418: Fixed that a malformed tags file can cause an heap-based buffer overflow out-of-bounds read (bsc#1259052)
• CVE-2026-28419: Fixed processing a malformed tags file containing a delimiter can lead to a crash (bsc#1259053)
• CVE-2026-28420: Fixed that processing maximum combining characters in terminal emulator can lead to heap-based buffer overflow write (bsc#1259054)
• CVE-2026-28421: Fixed that a crafted swap file can cause a heap-buffer-overflow and a segmentation fault
• CVE-2026-28422: Fixed that a malicious modeline or plugin can trigger a stack-buffer-overflow (bsc#1259056)

This update for vim fixes the following issues:

Update Vim to version 9.2.0110:

• CVE-2025-53906: malicious zip archive may cause a path traversal in Vim's zip (bsc#1246602).
• CVE-2026-26269: Netbeans specialKeys stack buffer overflow (bsc#1258229).
• CVE-2026-28417: Fixed that a crafted URL parsed by netrw plugin can lead to execute arbitrary shell commands (bsc#1259051).
• CVE-2026-28418: Fixed that a malformed tags file can cause an heap-based buffer overflow out-of-bounds read (bsc#1259052)
• CVE-2026-28419: Fixed processing a malformed tags file containing a delimiter can lead to a crash (bsc#1259053)
• CVE-2026-28420: Fixed that processing maximum combining characters in terminal emulator can lead to heap-based buffer overflow write (bsc#1259054)
• CVE-2026-28421: Fixed that a crafted swap file can cause a heap-buffer-overflow and a segmentation fault
• CVE-2026-28422: Fixed that a malicious modeline or plugin can trigger a stack-buffer-overflow (bsc#1259056)

This update for vim fixes the following issues:

Update Vim to version 9.2.0110:

• CVE-2025-53906: Fixed that malicious zip archive may cause a path traversal in Vim's zip (bsc#1246602).
• CVE-2026-26269: Fixed Netbeans specialKeys stack buffer overflow (bsc#1258229).
• CVE-2026-28417: Fixed crafted URL parsed by netrw plugin can lead to execute arbitrary shell commands (bsc#1259051).
• CVE-2026-28418: Fixed that a malformed tags file can cause an heap-based buffer overflow out-of-bounds read (bsc#1259052)
• CVE-2026-28419: Fixed processing a malformed tags file containing a delimiter can lead to a crash (bsc#1259053)
• CVE-2026-28420: Fixed that processing maximum combining characters in terminal emulator can lead to heap-based buffer overflow write (bsc#1259054)
• CVE-2026-28421: Fixed that a crafted swap file can cause a heap-buffer-overflow and a segmentation fault
• CVE-2026-28422: Fixed that a malicious modeline or plugin can trigger a stack-buffer-overflow (bsc#1259056)