CVE-2026-32249
NFA regex engine NULL pointer dereference affects Vim < 9.2.0137
Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a character range (e.g. [0-0\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states. This corrupts the NFA postfix stack, resulting in NFA_START_COLL having a NULL out1 pointer. When nfa_max_width() subsequently traverses the compiled NFA to estimate match width for the look-behind assertion, it dereferences state->out1->out without a NULL check, causing a segmentation fault. This vulnerability is fixed in 9.2.0137.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
NFA regex engine NULL pointer dereference affects Vim < 9.2.0137
Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a character range (e.g. [0-0\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states. This corrupts the NFA postfix stack, resulting in NFA_START_COLL having a NULL out1 pointer. When nfa_max_width() subsequently traverses the compiled NFA to estimate match width for the look-behind assertion, it dereferences state->out1->out without a NULL check, causing a segmentation fault. This vulnerability is fixed in 9.2.0137.
- Record
CVE-2026-32249- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-476
- Updated
- 2026-11-02
EUVDEUVD-2026-11690
Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a character range (e.g. [0-0\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states. This corrupts the NFA postfix stack, resulting in NFA_START_COLL having a NULL out1 pointer. When nfa_max_width() subsequently traverses the compiled NFA to estimate match width for the look-behind assertion, it dereferences state->out1->out without a NULL check, causing a segmentation fault. This vulnerability is fixed in 9.2.0137.
- Record
EUVD-2026-11690- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
NVD
Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a character range (e.g. [0-0\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states. This corrupts the NFA postfix stack, resulting in NFA_START_COLL having a NULL out1 pointer. When nfa_max_width() subsequently traverses the compiled NFA to estimate match width for the look-behind assertion, it dereferences state->out1->out without a NULL check, causing a segmentation fault. This vulnerability is fixed in 9.2.0137.
- Record
CVE-2026-32249- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-32249
Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a character range (e.g. [0-0\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states. This corrupts the NFA postfix stack, resulting in NFA_START_COLL having a NULL out1 pointer. When nfa_max_width() subsequently traverses the compiled NFA to estimate match width for the look-behind assertion, it dereferences state->out1->out without a NULL check, causing a segmentation fault. This vulnerability is fixed in 9.2.0137.
- Record
ALPINE-CVE-2026-32249- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVBELL-CVE-2026-32249
- Record
BELL-CVE-2026-32249- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
NFA regex engine NULL pointer dereference affects Vim < 9.2.0137
Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a character range (e.g. [0-0\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states. This corrupts the NFA postfix stack, resulting in NFA_START_COLL having a NULL out1 pointer. When nfa_max_width() subsequently traverses the compiled NFA to estimate match width for the look-behind assertion, it dereferences state->out1->out without a NULL check, causing a segmentation fault. This vulnerability is fixed in 9.2.0137.
- Record
CVE-2026-32249- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-476
- Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2026-32249
Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a character range (e.g. [0-0\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states. This corrupts the NFA postfix stack, resulting in NFA_START_COLL having a NULL out1 pointer. When nfa_max_width() subsequently traverses the compiled NFA to estimate match width for the look-behind assertion, it dereferences state->out1->out without a NULL check, causing a segmentation fault. This vulnerability is fixed in 9.2.0137.
- Record
DEBIAN-CVE-2026-32249- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-32249
Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a character range (e.g. [0-0\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states. This corrupts the NFA postfix stack, resulting in NFA_START_COLL having a NULL out1 pointer. When nfa_max_width() subsequently traverses the compiled NFA to estimate match width for the look-behind assertion, it dereferences state->out1->out without a NULL check, causing a segmentation fault. This vulnerability is fixed in 9.2.0137.
- Record
UBUNTU-CVE-2026-32249- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-79845 No score
CVE-2026-32249 affecting package vim for versions less than 9.2.0240-1
Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a character range (e.g. [0-0\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states. This corrupts the NFA postfix stack, resulting in NFA_START_COLL having a NULL out1 pointer. When nfa_max_width() subsequently traverses the compiled NFA to estimate match width for the look-behind assertion, it dereferences state->out1->out without a NULL check, causing a segmentation fault. This vulnerability is fixed in 9.2.0137.
- Record
AZL-79845- Updated
- 2026-11-02
OSVMGASA-2026-0055 No score
Updated vim packages fix security vulnerability
NFA regex engine NULL pointer dereference affects Vim < 9.2.0137. (CVE-2026-32249)
- Record
MGASA-2026-0055- Updated
- 2026-11-02
OSVUSN-8171-1 No score
vim vulnerabilities
Nathan Mills discovered that Vim could crash when parsing certain regular expressions. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10 (CVE-2026-32249)
It was discovered that Vim did not properly sanitize user input. An attacker could possibly use this issue to execute arbitrary commands. (CVE-2026-33412)
Avishay Matayev discovered that Vim's modeline sandbox could be bypassed when opening a maliciously-crafted file. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-2026-34982)
- Record
USN-8171-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vimAlpine:v3.23 |
9.1.0011 up to 9.2.0140-r0 | 9.2.0140-r0 |
vimAlpine:v3.24 |
9.1.0011 up to 9.2.0140-r0 | 9.2.0140-r0 |
vimAzure Linux:3 |
before 9.2.0240-1 | 9.2.0240-1 |
vimAlpaquita:23 |
9.1.0936-r0 up to 9.2.0140-r0 | 9.2.0140-r0 |
vimAlpaquita:25 |
9.1.1415-r0 up to 9.2.0140-r0 | 9.2.0140-r0 |
vimAlpaquita:stream |
9.1.0414-r0 up to 9.2.0140-r0 | 9.2.0140-r0 |
vimDebian:13 |
before 2:9.1.1230-2+deb13u1, plus listed versions 2:9.1.1230-2 |
2:9.1.1230-2+deb13u1 |
vimDebian:14 |
before 2:9.2.0218-1, plus listed versions 2:9.1.1230-22:9.1.1385-12:9.1.1766-12:9.1.1829-12:9.1.1846-1 Show 5 moreShow less2:9.1.1882-12:9.1.2103-12:9.1.2141-12:9.2.0119-12:9.2.0136-1 |
2:9.2.0218-1 |
vimMageia:9 |
before 9.2.140-1.mga9 | 9.2.140-1.mga9 |
vimUbuntu:24.04:LTS |
before 2:9.1.0016-1ubuntu7.11, plus listed versions 2:9.0.1672-1ubuntu22:9.0.2087-1ubuntu12:9.0.2116-1ubuntu12:9.0.2116-1ubuntu22:9.0.2184-0ubuntu1 Show 15 moreShow less2:9.0.2189-1ubuntu12:9.1.0-1ubuntu12:9.1.0016-1ubuntu22:9.1.0016-1ubuntu62:9.1.0016-1ubuntu72:9.1.0016-1ubuntu7.12:9.1.0016-1ubuntu7.22:9.1.0016-1ubuntu7.32:9.1.0016-1ubuntu7.42:9.1.0016-1ubuntu7.52:9.1.0016-1ubuntu7.62:9.1.0016-1ubuntu7.72:9.1.0016-1ubuntu7.82:9.1.0016-1ubuntu7.92:9.1.0016-1ubuntu7.10 |
2:9.1.0016-1ubuntu7.11 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
vimUbuntu:25.10 |
before 2:9.1.0967-1ubuntu6.2, plus listed versions 2:9.1.0967-1ubuntu42:9.1.0967-1ubuntu52:9.1.0967-1ubuntu62:9.1.0967-1ubuntu6.1 |
2:9.1.0967-1ubuntu6.2 |
vimUbuntu:Pro:14.04:LTS |
before 2:7.4.052-1ubuntu3.1+esm24, plus listed versions 2:7.4.000-1ubuntu22:7.4.052-1ubuntu12:7.4.052-1ubuntu22:7.4.052-1ubuntu32:7.4.052-1ubuntu3.1 Show 22 moreShow less2:7.4.052-1ubuntu3.1+esm12:7.4.052-1ubuntu3.1+esm32:7.4.052-1ubuntu3.1+esm42:7.4.052-1ubuntu3.1+esm52:7.4.052-1ubuntu3.1+esm62:7.4.052-1ubuntu3.1+esm72:7.4.052-1ubuntu3.1+esm82:7.4.052-1ubuntu3.1+esm92:7.4.052-1ubuntu3.1+esm102:7.4.052-1ubuntu3.1+esm112:7.4.052-1ubuntu3.1+esm122:7.4.052-1ubuntu3.1+esm132:7.4.052-1ubuntu3.1+esm142:7.4.052-1ubuntu3.1+esm152:7.4.052-1ubuntu3.1+esm162:7.4.052-1ubuntu3.1+esm172:7.4.052-1ubuntu3.1+esm182:7.4.052-1ubuntu3.1+esm192:7.4.052-1ubuntu3.1+esm202:7.4.052-1ubuntu3.1+esm212:7.4.052-1ubuntu3.1+esm222:7.4.052-1ubuntu3.1+esm23 |
2:7.4.052-1ubuntu3.1+esm24 |
vimUbuntu:Pro:16.04:LTS |
before 2:7.4.1689-3ubuntu1.5+esm30, plus listed versions 2:7.4.712-2ubuntu42:7.4.826-1ubuntu12:7.4.826-1ubuntu22:7.4.826-1ubuntu32:7.4.963-1ubuntu1 Show 33 moreShow less2:7.4.963-1ubuntu42:7.4.963-1ubuntu52:7.4.1689-3ubuntu12:7.4.1689-3ubuntu1.12:7.4.1689-3ubuntu1.22:7.4.1689-3ubuntu1.32:7.4.1689-3ubuntu1.42:7.4.1689-3ubuntu1.52:7.4.1689-3ubuntu1.5+esm22:7.4.1689-3ubuntu1.5+esm32:7.4.1689-3ubuntu1.5+esm42:7.4.1689-3ubuntu1.5+esm52:7.4.1689-3ubuntu1.5+esm62:7.4.1689-3ubuntu1.5+esm72:7.4.1689-3ubuntu1.5+esm82:7.4.1689-3ubuntu1.5+esm102:7.4.1689-3ubuntu1.5+esm112:7.4.1689-3ubuntu1.5+esm122:7.4.1689-3ubuntu1.5+esm132:7.4.1689-3ubuntu1.5+esm142:7.4.1689-3ubuntu1.5+esm152:7.4.1689-3ubuntu1.5+esm172:7.4.1689-3ubuntu1.5+esm182:7.4.1689-3ubuntu1.5+esm192:7.4.1689-3ubuntu1.5+esm202:7.4.1689-3ubuntu1.5+esm222:7.4.1689-3ubuntu1.5+esm232:7.4.1689-3ubuntu1.5+esm242:7.4.1689-3ubuntu1.5+esm252:7.4.1689-3ubuntu1.5+esm262:7.4.1689-3ubuntu1.5+esm272:7.4.1689-3ubuntu1.5+esm282:7.4.1689-3ubuntu1.5+esm29 |
2:7.4.1689-3ubuntu1.5+esm30 |
vimUbuntu:Pro:18.04:LTS |
before 2:8.0.1453-1ubuntu1.13+esm15, plus listed versions 2:8.0.0197-4ubuntu52:8.0.1144-1ubuntu12:8.0.1401-1ubuntu12:8.0.1401-1ubuntu22:8.0.1401-1ubuntu3 Show 25 moreShow less2:8.0.1453-1ubuntu12:8.0.1453-1ubuntu1.12:8.0.1453-1ubuntu1.32:8.0.1453-1ubuntu1.42:8.0.1453-1ubuntu1.62:8.0.1453-1ubuntu1.72:8.0.1453-1ubuntu1.82:8.0.1453-1ubuntu1.92:8.0.1453-1ubuntu1.102:8.0.1453-1ubuntu1.112:8.0.1453-1ubuntu1.122:8.0.1453-1ubuntu1.132:8.0.1453-1ubuntu1.13+esm12:8.0.1453-1ubuntu1.13+esm32:8.0.1453-1ubuntu1.13+esm42:8.0.1453-1ubuntu1.13+esm52:8.0.1453-1ubuntu1.13+esm62:8.0.1453-1ubuntu1.13+esm72:8.0.1453-1ubuntu1.13+esm82:8.0.1453-1ubuntu1.13+esm92:8.0.1453-1ubuntu1.13+esm102:8.0.1453-1ubuntu1.13+esm112:8.0.1453-1ubuntu1.13+esm122:8.0.1453-1ubuntu1.13+esm132:8.0.1453-1ubuntu1.13+esm14 |
2:8.0.1453-1ubuntu1.13+esm15 |
vimUbuntu:Pro:20.04:LTS |
before 2:8.1.2269-1ubuntu5.32+esm3, plus listed versions 2:8.1.0875-5ubuntu22:8.1.0875-5ubuntu32:8.1.0875-5ubuntu42:8.1.2269-1ubuntu12:8.1.2269-1ubuntu4 Show 27 moreShow less2:8.1.2269-1ubuntu52:8.1.2269-1ubuntu5.32:8.1.2269-1ubuntu5.42:8.1.2269-1ubuntu5.62:8.1.2269-1ubuntu5.72:8.1.2269-1ubuntu5.82:8.1.2269-1ubuntu5.92:8.1.2269-1ubuntu5.112:8.1.2269-1ubuntu5.122:8.1.2269-1ubuntu5.132:8.1.2269-1ubuntu5.142:8.1.2269-1ubuntu5.152:8.1.2269-1ubuntu5.162:8.1.2269-1ubuntu5.172:8.1.2269-1ubuntu5.182:8.1.2269-1ubuntu5.202:8.1.2269-1ubuntu5.212:8.1.2269-1ubuntu5.222:8.1.2269-1ubuntu5.232:8.1.2269-1ubuntu5.242:8.1.2269-1ubuntu5.252:8.1.2269-1ubuntu5.262:8.1.2269-1ubuntu5.292:8.1.2269-1ubuntu5.302:8.1.2269-1ubuntu5.312:8.1.2269-1ubuntu5.322:8.1.2269-1ubuntu5.32+esm2 |
2:8.1.2269-1ubuntu5.32+esm3 |
vimUbuntu:22.04:LTS |
before 2:8.2.3995-1ubuntu2.27, plus listed versions 2:8.2.2434-3ubuntu32:8.2.2434-3ubuntu42:8.2.3565-1ubuntu12:8.2.3565-1ubuntu22:8.2.3565-1ubuntu3 Show 25 moreShow less2:8.2.3565-1ubuntu52:8.2.3995-1ubuntu12:8.2.3995-1ubuntu22:8.2.3995-1ubuntu2.12:8.2.3995-1ubuntu2.32:8.2.3995-1ubuntu2.42:8.2.3995-1ubuntu2.52:8.2.3995-1ubuntu2.72:8.2.3995-1ubuntu2.82:8.2.3995-1ubuntu2.92:8.2.3995-1ubuntu2.102:8.2.3995-1ubuntu2.112:8.2.3995-1ubuntu2.122:8.2.3995-1ubuntu2.132:8.2.3995-1ubuntu2.152:8.2.3995-1ubuntu2.162:8.2.3995-1ubuntu2.172:8.2.3995-1ubuntu2.182:8.2.3995-1ubuntu2.192:8.2.3995-1ubuntu2.202:8.2.3995-1ubuntu2.212:8.2.3995-1ubuntu2.222:8.2.3995-1ubuntu2.232:8.2.3995-1ubuntu2.242:8.2.3995-1ubuntu2.26 |
2:8.2.3995-1ubuntu2.27 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-32249 is a medium vulnerability (CVSS 5.3) in Vim, published March 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 5th percentile. Fixed in vim 9.2.0140-r0.
References
github.com/vim/vim/security/advisories/GHSA-9phh-423r-778r
security.alpinelinux.org/vuln/CVE-2026-32249
nvd.nist.gov/vuln/detail/CVE-2026-32249
docs.bell-sw.com/security/cves/CVE-2026-32249
Show 10 moreShow less
security-tracker.debian.org/tracker/CVE-2026-32249
advisories.mageia.org/MGASA-2026-0055.html
bugs.mageia.org/show_bug.cgi?id=35197
openwall.com/lists/oss-security/2026/03/11/6
ubuntu.com/security/CVE-2026-32249
cve.org/CVERecord?id=CVE-2026-32249