Every CVE Search/ Get API key

CVE-2026-34714

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in...

9.2 CriticalFix available

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
Low

Exploit likelihood

0.60%Up 0.6 points since Mar 31, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.2

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.

Record
CVE-2026-34714
CVSS 3.1
9.2 CriticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-78, CWE-917
Updated
2026-11-02
EUVDEUVD-2026-17160 9.2

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.

Record
EUVD-2026-17160
CVSS 3.1
9.2 CriticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-mfxw-q267-mgp6 9.2

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in...

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.

Record
GHSA-mfxw-q267-mgp6
CVSS 3.1
9.2 CriticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Weakness
CWE-78, CWE-917
Updated
2026-11-02
NVD 9.2

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.

Record
CVE-2026-34714
CVSS 3.1
9.2 CriticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-78, CWE-917
Updated
2026-11-02
OSVALPINE-CVE-2026-34714 8.6

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.

Record
ALPINE-CVE-2026-34714
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-03
OSVBELL-CVE-2026-34714 8.6
Record
BELL-CVE-2026-34714
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
Show 15 moreShow less
OSV 9.2

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.

Record
CVE-2026-34714
CVSS 3.1
9.2 CriticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Weakness
CWE-78
Updated
2026-11-02
OSVDEBIAN-CVE-2026-34714 8.6

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.

Record
DEBIAN-CVE-2026-34714
CVSS 3.1
8.6 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-81195 No score

CVE-2026-34714 affecting package vim for versions less than 9.2.0315-1

Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE.

Record
AZL-81195
Updated
2026-11-02
OSVMGASA-2026-0077 No score

Updated vim packages fix security vulnerability

Vim tabpanel modeline escape affects Vim < 9.2.0272.

Record
MGASA-2026-0077
Updated
2026-11-02
OSVopenSUSE-SU-2026:10652-1 No score

gvim-9.2.0398-1.1 on GA media

These are all security issues fixed in the gvim-9.2.0398-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10652-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20540-1 No score

Security update for vim

This update for vim fixes the following issues:

  • CVE-2026-33412: command injection via newline in glob() (bsc#1259985).
  • CVE-2026-34714: crafted file can allow code execution (bsc#1261191).
  • CVE-2026-34982: Vim modeline bypass via various options (bsc#1261271).
Record
openSUSE-SU-2026:20540-1
Updated
2026-11-02
OSVSUSE-SU-2026:1347-1 No score

Security update for vim

This update for vim fixes the following issues:

Update to version 9.2.0280.

  • CVE-2026-34982: missing input validation allows for a modeline sandbox bypass and can lead to arbitrary OS command execution (bsc#1261271).
  • CVE-2026-34714: missing checks allow for a tabpanel modeline escape and can lead to arbitrary OS command execution (bsc#1261191).
  • CVE-2026-33412: improper escaping of newline characters allows for command injection in glob and can lead to arbitrary code execution (bsc#1259985).
Record
SUSE-SU-2026:1347-1
Updated
2026-11-02
OSVSUSE-SU-2026:1387-1 No score

Security update for vim

This update for vim fixes the following issues:

Update to version 9.2.0280.

  • CVE-2026-34982: missing input validation allows for a modeline sandbox bypass and can lead to arbitrary OS command execution (bsc#1261271).
  • CVE-2026-34714: missing checks allow for a tabpanel modeline escape and can lead to arbitrary OS command execution (bsc#1261191).
  • CVE-2026-33412: improper escaping of newline characters allows for command injection in glob and can lead to arbitrary code execution (bsc#1259985).
Record
SUSE-SU-2026:1387-1
Updated
2026-11-02
OSVSUSE-SU-2026:1607-1 No score

Security update for vim

This update for vim fixes the following issues:

Update to version 9.2.0280.

  • CVE-2026-34982: missing input validation allows for a modeline sandbox bypass and can lead to arbitrary OS command execution (bsc#1261271).
  • CVE-2026-34714: missing checks allow for a tabpanel modeline escape and can lead to arbitrary OS command execution (bsc#1261191).
  • CVE-2026-33412: improper escaping of newline characters allows for command injection in glob and can lead to arbitrary code execution (bsc#1259985).
Record
SUSE-SU-2026:1607-1
Updated
2026-11-02
OSVSUSE-SU-2026:21118-1 No score

Security update for vim

This update for vim fixes the following issues:

  • Update to 9.2.0280
  • CVE-2026-33412: command injection via newline in glob() (bsc#1259985).
  • CVE-2026-34714: crafted file can allow code execution (bsc#1261191).
  • CVE-2026-34982: Vim modeline bypass via various options (bsc#1261271).
Record
SUSE-SU-2026:21118-1
Updated
2026-11-02
OSVSUSE-SU-2026:21124-1 No score

Security update for vim

This update for vim fixes the following issues:

  • Update to 9.2.0280
  • CVE-2026-33412: command injection via newline in glob() (bsc#1259985).
  • CVE-2026-34714: crafted file can allow code execution (bsc#1261191).
  • CVE-2026-34982: Vim modeline bypass via various options (bsc#1261271).
Record
SUSE-SU-2026:21124-1
Updated
2026-11-02
OSVSUSE-SU-2026:21134-1 No score

Security update for vim

This update for vim fixes the following issues:

  • CVE-2026-33412: command injection via newline in glob() (bsc#1259985).
  • CVE-2026-34714: crafted file can allow code execution (bsc#1261191).
  • CVE-2026-34982: Vim modeline bypass via various options (bsc#1261271).
Record
SUSE-SU-2026:21134-1
Updated
2026-11-02
OSVSUSE-SU-2026:21136-1 No score

Security update for vim

This update for vim fixes the following issues:

  • CVE-2026-33412: command injection via newline in glob() (bsc#1259985).
  • CVE-2026-34714: crafted file can allow code execution (bsc#1261191).
  • CVE-2026-34982: Vim modeline bypass via various options (bsc#1261271).
Record
SUSE-SU-2026:21136-1
Updated
2026-11-02
OSVSUSE-SU-2026:21197-1 No score

Security update for vim

This update for vim fixes the following issues:

  • CVE-2026-33412: command injection via newline in glob() (bsc#1259985).
  • CVE-2026-34714: crafted file can allow code execution (bsc#1261191).
  • CVE-2026-34982: Vim modeline bypass via various options (bsc#1261271).
Record
SUSE-SU-2026:21197-1
Updated
2026-11-02
OSVUBUNTU-CVE-2026-34714 No score

(Vim before 9.2.0272 allows code execution that happens immediately upo ...)

Record
UBUNTU-CVE-2026-34714
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
vim
Alpine:v3.23
 9.1.1390 up to 9.2.0272-r0
9.2.0272-r0
vim
Alpine:v3.24
 9.1.1390 up to 9.2.0272-r0
9.2.0272-r0
vim
Azure Linux:3
 before 9.2.0315-1
9.2.0315-1
vim
Alpaquita:23
 9.0.0820-r2 up to 9.2.0272-r0
9.2.0272-r0
vim
Alpaquita:25
 9.1.1415-r0 up to 9.2.0272-r0
9.2.0272-r0
vim
Alpaquita:stream
 9.0.1395-r0 up to 9.2.0291-r0
9.2.0291-r0
vim
Debian:14
 before 2:9.2.0315-1, plus listed versions
2:9.1.1230-22:9.1.1385-12:9.1.1766-12:9.1.1829-12:9.1.1846-1
Show 6 moreShow less
2:9.1.1882-12:9.1.2103-12:9.1.2141-12:9.2.0119-12:9.2.0136-12:9.2.0218-1
2:9.2.0315-1
vim
Mageia:9
 before 9.2.272-1.mga9
9.2.272-1.mga9
vim
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 3 CVEs
 before 9.2.0280-17.62.1
9.2.0280-17.62.1
vim
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 3 CVEs
 before 9.2.0280-17.62.1
9.2.0280-17.62.1
Show 25 moreShow less
Affected packages
PackageAffectedFixed
vim
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 3 CVEs
 before 9.2.0280-150000.5.89.1
9.2.0280-150000.5.89.1
vim
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 3 CVEs
 before 9.2.0280-150000.5.89.1
9.2.0280-150000.5.89.1
vim
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 3 CVEs
 before 9.2.0280-150000.5.89.1
9.2.0280-150000.5.89.1
vim
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 3 CVEs
 before 9.2.0280-150000.5.89.1
9.2.0280-150000.5.89.1
vim
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 3 CVEs
 before 9.2.0280-150000.5.89.1
9.2.0280-150000.5.89.1
vim
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 3 CVEs
 before 9.2.0280-150000.5.89.1
9.2.0280-150000.5.89.1
vim
SUSE:Linux Enterprise Micro 5.2
From an advisory covering 3 CVEs
 before 9.2.0280-150000.5.89.1
9.2.0280-150000.5.89.1
vim
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 3 CVEs
 before 9.2.0280-150500.20.46.1
9.2.0280-150500.20.46.1
vim
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 3 CVEs
 before 9.2.0280-150500.20.46.1
9.2.0280-150500.20.46.1
vim
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
From an advisory covering 3 CVEs
 before 9.2.0280-150500.20.46.1
9.2.0280-150500.20.46.1
vim
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 3 CVEs
 before 9.2.0280-150500.20.46.1
9.2.0280-150500.20.46.1
vim
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 3 CVEs
 before 9.2.0280-150500.20.46.1
9.2.0280-150500.20.46.1
vim
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 3 CVEs
 before 9.2.0280-150500.20.46.1
9.2.0280-150500.20.46.1
vim
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 3 CVEs
 before 9.2.0280-150500.20.46.1
9.2.0280-150500.20.46.1
vim
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 3 CVEs
 before 9.2.0280-150500.20.46.1
9.2.0280-150500.20.46.1
vim
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 3 CVEs
 before 9.2.0280-150500.20.46.1
9.2.0280-150500.20.46.1
vim
openSUSE:Leap 15.6
From an advisory covering 3 CVEs
 before 9.2.0280-150500.20.46.1
9.2.0280-150500.20.46.1
vim
SUSE:Linux Micro 6.1
From an advisory covering 3 CVEs
 before 9.2.0280-slfo.1.1_1.1
9.2.0280-slfo.1.1_1.1
vim
SUSE:Linux Micro 6.0
From an advisory covering 3 CVEs
 before 9.2.0280-1.1
9.2.0280-1.1
vim
SUSE:Linux Micro 6.2
From an advisory covering 3 CVEs
 before 9.2.0280-160000.1.1
9.2.0280-160000.1.1
vim
SUSE:Linux Micro Extras 6.2
From an advisory covering 3 CVEs
 before 9.2.0280-160000.1.1
9.2.0280-160000.1.1
vim
SUSE:Linux Enterprise Server 16.0
From an advisory covering 3 CVEs
 before 9.2.0280-160000.1.1
9.2.0280-160000.1.1
vim
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 3 CVEs
 before 9.2.0280-160000.1.1
9.2.0280-160000.1.1
vim
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 9.2.0398-1.1
9.2.0398-1.1
vim
openSUSE:Leap 16.0
From an advisory covering 3 CVEs
 before 9.2.0280-160000.1.1
9.2.0280-160000.1.1

History

History
RecordedChangedSources
affected, facts
affectedOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-34714 is a critical vulnerability (CVSS 9.2) in Vim, published March 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 48th percentile. Fixed in vim 9.2.0272-r0.

References

Show 29 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open