CVE-2026-28422

Vim is an open source, command line text editor. Prior to version 9.2.0078, a stack-buffer-overflow occurs in build_stl_str_hl() when rendering a statusline with a multi-byte fill character on a very wide terminal. Version 9.2.0078 patches the issue.

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.

Security Fix(es):

Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the scp:// protocol handler), an attacker can execute arbitrary shell commands with the privileges of the Vim process. Version 9.2.0073 fixes the issue.(CVE-2026-28417)

Vim is an open source, command line text editor. Prior to version 9.2.0074, a heap-based buffer overflow out-of-bounds read exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file, Vim can be tricked into reading up to 7 bytes beyond the allocated memory boundary. Version 9.2.0074 fixes the issue.(CVE-2026-28418)

Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a delimiter appears at the start of a line, Vim attempts to read memory immediately preceding the allocated buffer. Version 9.2.0075 fixes the issue.(CVE-2026-28419)

Vim is an open source, command line text editor. Prior to version 9.2.0076, a heap-based buffer overflow WRITE and an out-of-bounds READ exist in Vim's terminal emulator when processing maximum combining characters from Unicode supplementary planes. Version 9.2.0076 fixes the issue.(CVE-2026-28420)

Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) exist in Vim's swap file recovery logic. Both are caused by unvalidated fields read from crafted pointer blocks within a swap file. Version 9.2.0077 fixes the issue.(CVE-2026-28421)

Vim is an open-source, command-line text editor. Prior to version 9.2.0078, a stack-buffer-overflow occurs in the build_stl_str_hl() function when rendering a statusline with a multi-byte fill character on a very wide terminal. This vulnerability may lead to application crash or potential security risks.(CVE-2026-28422)

Vim is an open source, command line text editor. Prior to version 9.2.0078, a stack-buffer-overflow occurs in build_stl_str_hl() when rendering a statusline with a multi-byte fill character on a very wide terminal. Version 9.2.0078 patches the issue.

Vim is an open source, command line text editor. Prior to version 9.2.0078, a stack-buffer-overflow occurs in build_stl_str_hl() when rendering a statusline with a multi-byte fill character on a very wide terminal. Version 9.2.0078 patches the issue.

• CVE-2022-0213: bound the space appended to the window status line so it cannot be written past the end of NameBuff
• CVE-2024-43802: check that the typeahead buffer has room before advancing the offset when flushing mapped characters
• CVE-2026-28422: account for the byte length of a multi-byte fill character when sizing the status line buffer and when padding item groups
• CVE-2022-0351: limit expression recursion depth so a deeply nested condition cannot exhaust the stack

• CVE-2022-0213: bound the space appended to the window status line so it cannot be written past the end of NameBuff
• CVE-2024-43802: check that the typeahead buffer has room before advancing the offset when flushing mapped characters
• CVE-2026-28422: account for the byte length of a multi-byte fill character when sizing the status line buffer and when padding item groups
• CVE-2022-0351: limit expression recursion depth so a deeply nested condition cannot exhaust the stack

OS Command Injection in netrw affects Vim < 9.2.0073. (CVE-2026-28417) Heap-based Buffer Overflow in Emacs tags parsing affects Vim < 9.2.0074. (CVE-2026-28418) Heap-based Buffer Underflow in Emacs tags parsing affects Vim < 9.2.0075. (CVE-2026-28419) Heap-based Buffer Overflow and OOB Read in :terminal affects Vim < 9.2.0076. (CVE-2026-28420) Multiple Vulnerabilities in Swap File Recovery affect Vim < 9.2.0077. (CVE-2026-28421) Stack-buffer-overflow in build_stl_str_hl() affects Vim < 9.2.0078. (CVE-2026-28422)

This update for vim fixes the following issues:

Update Vim to version 9.2.0110:

• CVE-2025-53906: Fixed that malicious zip archive may cause a path traversal in Vim's zip (bsc#1246602).
• CVE-2026-26269: Fixed Netbeans specialKeys stack buffer overflow (bsc#1258229).
• CVE-2026-28417: Fixed that a crafted URL parsed by netrw plugin can lead to execute arbitrary shell commands (bsc#1259051).
• CVE-2026-28418: Fixed that a malformed tags file can cause an heap-based buffer overflow out-of-bounds read (bsc#1259052)
• CVE-2026-28419: Fixed processing a malformed tags file containing a delimiter can lead to a crash (bsc#1259053)
• CVE-2026-28420: Fixed that processing maximum combining characters in terminal emulator can lead to heap-based buffer overflow write (bsc#1259054)
• CVE-2026-28421: Fixed that a crafted swap file can cause a heap-buffer-overflow and a segmentation fault
• CVE-2026-28422: Fixed that a malicious modeline or plugin can trigger a stack-buffer-overflow (bsc#1259056)

This update for vim fixes the following issues:

Update Vim to version 9.2.0110:

• CVE-2025-53906: malicious zip archive may cause a path traversal in Vim's zip (bsc#1246602).
• CVE-2026-26269: Netbeans specialKeys stack buffer overflow (bsc#1258229).
• CVE-2026-28417: Fixed that a crafted URL parsed by netrw plugin can lead to execute arbitrary shell commands (bsc#1259051).
• CVE-2026-28418: Fixed that a malformed tags file can cause an heap-based buffer overflow out-of-bounds read (bsc#1259052)
• CVE-2026-28419: Fixed processing a malformed tags file containing a delimiter can lead to a crash (bsc#1259053)
• CVE-2026-28420: Fixed that processing maximum combining characters in terminal emulator can lead to heap-based buffer overflow write (bsc#1259054)
• CVE-2026-28421: Fixed that a crafted swap file can cause a heap-buffer-overflow and a segmentation fault
• CVE-2026-28422: Fixed that a malicious modeline or plugin can trigger a stack-buffer-overflow (bsc#1259056)

This update for vim fixes the following issues:

Update Vim to version 9.2.0110:

• CVE-2025-53906: Fixed that malicious zip archive may cause a path traversal in Vim's zip (bsc#1246602).
• CVE-2026-26269: Fixed Netbeans specialKeys stack buffer overflow (bsc#1258229).
• CVE-2026-28417: Fixed crafted URL parsed by netrw plugin can lead to execute arbitrary shell commands (bsc#1259051).
• CVE-2026-28418: Fixed that a malformed tags file can cause an heap-based buffer overflow out-of-bounds read (bsc#1259052)
• CVE-2026-28419: Fixed processing a malformed tags file containing a delimiter can lead to a crash (bsc#1259053)
• CVE-2026-28420: Fixed that processing maximum combining characters in terminal emulator can lead to heap-based buffer overflow write (bsc#1259054)
• CVE-2026-28421: Fixed that a crafted swap file can cause a heap-buffer-overflow and a segmentation fault
• CVE-2026-28422: Fixed that a malicious modeline or plugin can trigger a stack-buffer-overflow (bsc#1259056)