Every CVE Search/ Get API key

CVE-2026-73075

Vim: Out-of-bounds Access in Popup Opacity Handling

4.6 MediumFix available

Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead of accounting for w_popup_topoff and causing an out-of-bounds read and conditional write. This issue is fixed in version 9.2.0843.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Active

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

0.09%Unchanged since Aug 12, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.6

Vim: Out-of-bounds Access in Popup Opacity Handling

Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead of accounting for w_popup_topoff and causing an out-of-bounds read and conditional write. This issue is fixed in version 9.2.0843.

Record
CVE-2026-73075
CVSS 4.0
4.6 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-124, CWE-125
Updated
2026-11-02
EUVDEUVD-2026-56230 4.6

Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead of accounting for w_popup_topoff and causing an out-of-bounds read and conditional write. This issue is fixed in version 9.2.0843.

Record
EUVD-2026-56230
CVSS 4.0
4.6 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
NVD 4.6

Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead of accounting for w_popup_topoff and causing an out-of-bounds read and conditional write. This issue is fixed in version 9.2.0843.

Record
CVE-2026-73075
CVSS 4.0
4.6 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-124, CWE-125
Updated
2026-11-02
OSVALPINE-CVE-2026-73075 3.9

Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead of accounting for w_popup_topoff and causing an out-of-bounds read and conditional write. This issue is fixed in version 9.2.0843.

Record
ALPINE-CVE-2026-73075
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-03
OSVBELL-CVE-2026-73075 3.9
Record
BELL-CVE-2026-73075
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSV 4.6

Vim: Out-of-bounds Access in Popup Opacity Handling

Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead of accounting for w_popup_topoff and causing an out-of-bounds read and conditional write. This issue is fixed in version 9.2.0843.

Record
CVE-2026-73075
CVSS 4.0
4.6 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-124, CWE-125
Updated
2026-11-02
Show 13 moreShow less
OSVDEBIAN-CVE-2026-73075 3.9

Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead of accounting for w_popup_topoff and causing an out-of-bounds read and conditional write. This issue is fixed in version 9.2.0843.

Record
DEBIAN-CVE-2026-73075
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-73075 4.6

Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead of accounting for w_popup_topoff and causing an out-of-bounds read and conditional write. This issue is fixed in version 9.2.0843.

Record
UBUNTU-CVE-2026-73075
CVSS 4.0
4.6 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVAZL-95973 No score

CVE-2026-73075 affecting package vim for versions less than 9.2.0957-1

Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead of accounting for w_popup_topoff and causing an out-of-bounds read and conditional write. This issue is fixed in version 9.2.0843.

Record
AZL-95973
Updated
2026-11-02
OSVMGASA-2026-0355 No score

Updated vim packages fix security vulnerabilities

Arbitrary Code Execution via Shell Keyword Lookup in Vim < 9.2.0839. (CVE-2026-73077) Arbitrary Code Execution via Netrw Menu Construction in Vim < 9.2.0840. (CVE-2026-73078) Heap Buffer Overflow in Text Property Handling in Vim < 9.2.0841. (CVE-2026-73074) Stack Buffer Overflow in the Vim Socket Server in Vim < 9.2.0842. (CVE-2026-73070) Out-of-bounds Access in Popup Opacity Handling in Vim >= 9.2.0469 && Vim < 9.2.0843. (CVE-2026-73075) Use-after-free in JSON Decoding in Vim >= 9.2.0511 && Vim < 9.2.0844. (CVE-2026-73071) Arbitrary Ex Command Execution in C Omni-Completion in Vim < 9.2.0845. (CVE-2026-73073) Heap Buffer Overflow when Loading a Spell File in Vim < 9.2.0846. (CVE-2026-73072) Arbitrary Command Execution via Malicious .VimballRecord Entry Replay in vimball.vim. (CVE-2026-73076)

Record
MGASA-2026-0355
Updated
2026-11-02
OSVopenSUSE-SU-2026:21671-1 No score

Security update for vim

This update for vim fixes the following issues:

Updated to version 9.2.0957.

Security issues fixed:

  • CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).
  • CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).
  • CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution (bsc#1275016).
  • CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution (bsc#1275015).
  • CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).
  • CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).
  • CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).
  • CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).

Other updates and bugfixes:

  • Version 9.2.0957.
    • tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).
    • tests: missing cleanup in test_mksession.vim (9.2.0782).
    • tests: personal spell files leak into later tests (9.2.0783).
    • crash when borrowing statusline highlight in silent Ex mode (9.2.0784).
    • WinResized not triggered when the whole Vim is resized (9.2.0785).
    • filetype: containerfile is not recognized (9.2.0786).
    • regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).
    • filetype: hip files are not recognized (9.2.0788).
    • 'statuslineopt' status line too high after a window is minimized (9.2.0789).
    • 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).
    • wincol() counts from right side for 'rightleft' (9.2.0791).
    • runtime(netrw): explore without optional dir broken (9.2.0792).
    • if session restored a tiny window, restore fails (9.2.0793).
    • extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).
    • popup menu shadow is not cleared when the menu shrinks (9.2.0795).
    • Visual block reselection wrong with 'virtualedit' (9.2.0796).
    • memory leak in get_qfline_items() on alloc failure (9.2.0797).
    • memory leak in compile_expr6() on alloc failure (9.2.0798).
    • memory leak in compile_def_function_body() on alloc failure (9.2.0799).
    • memory leak in call_func() on alloc failure (9.2.0800).
    • memory leak in f_getreginfo() on alloc failure (9.2.0801).
    • memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).
    • memory leak on alloc failure with taglist/gettagstack() (9.2.0803).
    • wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).
    • screenpos() "curscol" is wrong with 'rightleft' (9.2.0805).
    • 'showcmd' may show internal command keys (9.2.0806).
    • MS-Windows: ellipsis character is garbled (9.2.0807).
    • getregionpos: double-free on alloc failure (9.2.0808).
    • getframelayout() uses wrong function to free lists (9.2.0809).
    • add_llist_tags() uses wrong function to free dict (9.2.0810).
    • mksession writes terminal command unquoted (9.2.0811).
    • :argdelete with pattern leads to wrong argidx() (9.2.0812).
    • dict_add_func() may corrupt funcref count on failure (9.2.0813).
    • Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).
    • deeply nested regexp patterns may cause stack overflow (9.2.0815).
    • GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).
    • crash when building a stacktrace during an autocommand (9.2.0817).
    • tests: client-server test fails without X11 server (9.2.0818).
    • MS-Windows: sixel image shown as raw text in the console (9.2.0819).
    • GUI: hidden popup image is displayed and not erased (9.2.0820).
    • filetype: msmtp system-wide rc file not detected (9.2.0821).
    • GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).
    • tests: Test_clientserver_servlist_list may fail (9.2.0823).
    • Makefile: make tags depends on configure (9.2.0824).
    • regexp:…
Record
openSUSE-SU-2026:21671-1
Updated
2026-11-02
OSVSUSE-SU-2026:23190-1 No score

Security update for vim

This update for vim fixes the following issues:

Updated to version 9.2.0957.

  • CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).
  • CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).
  • CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution (bsc#1275016).
  • CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution (bsc#1275015).
  • CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).
  • CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).
  • CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).
  • CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).

Changes for vim:

  • Version 9.2.0957:
    • tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).
    • tests: missing cleanup in test_mksession.vim (9.2.0782).
    • tests: personal spell files leak into later tests (9.2.0783).
    • crash when borrowing statusline highlight in silent Ex mode (9.2.0784).
    • WinResized not triggered when the whole Vim is resized (9.2.0785).
    • filetype: containerfile is not recognized (9.2.0786).
    • regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).
    • filetype: hip files are not recognized (9.2.0788).
    • 'statuslineopt' status line too high after a window is minimized (9.2.0789).
    • 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).
    • wincol() counts from right side for 'rightleft' (9.2.0791).
    • runtime(netrw): explore without optional dir broken (9.2.0792).
    • if session restored a tiny window, restore fails (9.2.0793).
    • extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).
    • popup menu shadow is not cleared when the menu shrinks (9.2.0795).
    • Visual block reselection wrong with 'virtualedit' (9.2.0796).
    • memory leak in get_qfline_items() on alloc failure (9.2.0797).
    • memory leak in compile_expr6() on alloc failure (9.2.0798).
    • memory leak in compile_def_function_body() on alloc failure (9.2.0799).
    • memory leak in call_func() on alloc failure (9.2.0800).
    • memory leak in f_getreginfo() on alloc failure (9.2.0801).
    • memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).
    • memory leak on alloc failure with taglist/gettagstack() (9.2.0803).
    • wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).
    • screenpos() "curscol" is wrong with 'rightleft' (9.2.0805).
    • 'showcmd' may show internal command keys (9.2.0806).
    • MS-Windows: ellipsis character is garbled (9.2.0807).
    • getregionpos: double-free on alloc failure (9.2.0808).
    • getframelayout() uses wrong function to free lists (9.2.0809).
    • add_llist_tags() uses wrong function to free dict (9.2.0810).
    • mksession writes terminal command unquoted (9.2.0811).
    • :argdelete with pattern leads to wrong argidx() (9.2.0812).
    • dict_add_func() may corrupt funcref count on failure (9.2.0813).
    • Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).
    • deeply nested regexp patterns may cause stack overflow (9.2.0815).
    • GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).
    • crash when building a stacktrace during an autocommand (9.2.0817).
    • tests: client-server test fails without X11 server (9.2.0818).
    • MS-Windows: sixel image shown as raw text in the console (9.2.0819).
    • GUI: hidden popup image is displayed and not erased (9.2.0820).
    • filetype: msmtp system-wide rc file not detected (9.2.0821).
    • GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).
    • tests: Test_clientserver_servlist_list may fail (9.2.0823).
    • Makefile: make tags depends on configure (9.2.0824).
    • regexp: submatch in a look-behind is empty…
Record
SUSE-SU-2026:23190-1
Updated
2026-11-02
OSVSUSE-SU-2026:23365-1 No score

Security update for vim

This update for vim fixes the following issues:

Updated to version 9.2.0957.

  • CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).
  • CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).
  • CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution (bsc#1275016).
  • CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution (bsc#1275015).
  • CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).
  • CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).
  • CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).
  • CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).

Changes for vim:

  • Version 9.2.0957:
    • tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).
    • tests: missing cleanup in test_mksession.vim (9.2.0782).
    • tests: personal spell files leak into later tests (9.2.0783).
    • crash when borrowing statusline highlight in silent Ex mode (9.2.0784).
    • WinResized not triggered when the whole Vim is resized (9.2.0785).
    • filetype: containerfile is not recognized (9.2.0786).
    • regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).
    • filetype: hip files are not recognized (9.2.0788).
    • 'statuslineopt' status line too high after a window is minimized (9.2.0789).
    • 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).
    • wincol() counts from right side for 'rightleft' (9.2.0791).
    • runtime(netrw): explore without optional dir broken (9.2.0792).
    • if session restored a tiny window, restore fails (9.2.0793).
    • extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).
    • popup menu shadow is not cleared when the menu shrinks (9.2.0795).
    • Visual block reselection wrong with 'virtualedit' (9.2.0796).
    • memory leak in get_qfline_items() on alloc failure (9.2.0797).
    • memory leak in compile_expr6() on alloc failure (9.2.0798).
    • memory leak in compile_def_function_body() on alloc failure (9.2.0799).
    • memory leak in call_func() on alloc failure (9.2.0800).
    • memory leak in f_getreginfo() on alloc failure (9.2.0801).
    • memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).
    • memory leak on alloc failure with taglist/gettagstack() (9.2.0803).
    • wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).
    • screenpos() "curscol" is wrong with 'rightleft' (9.2.0805).
    • 'showcmd' may show internal command keys (9.2.0806).
    • MS-Windows: ellipsis character is garbled (9.2.0807).
    • getregionpos: double-free on alloc failure (9.2.0808).
    • getframelayout() uses wrong function to free lists (9.2.0809).
    • add_llist_tags() uses wrong function to free dict (9.2.0810).
    • mksession writes terminal command unquoted (9.2.0811).
    • :argdelete with pattern leads to wrong argidx() (9.2.0812).
    • dict_add_func() may corrupt funcref count on failure (9.2.0813).
    • Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).
    • deeply nested regexp patterns may cause stack overflow (9.2.0815).
    • GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).
    • crash when building a stacktrace during an autocommand (9.2.0817).
    • tests: client-server test fails without X11 server (9.2.0818).
    • MS-Windows: sixel image shown as raw text in the console (9.2.0819).
    • GUI: hidden popup image is displayed and not erased (9.2.0820).
    • filetype: msmtp system-wide rc file not detected (9.2.0821).
    • GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).
    • tests: Test_clientserver_servlist_list may fail (9.2.0823).
    • Makefile: make tags depends on configure (9.2.0824).
    • regexp: submatch in a look-behind is empty…
Record
SUSE-SU-2026:23365-1
Updated
2026-11-02
OSVSUSE-SU-2026:23391-1 No score

Security update for vim

This update for vim fixes the following issues:

Updated to version 9.2.0957.

Security issues fixed:

  • CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).
  • CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).
  • CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution (bsc#1275016).
  • CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution (bsc#1275015).
  • CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).
  • CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).
  • CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).
  • CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).

Other updates and bugfixes:

  • Version 9.2.0957.
    • tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).
    • tests: missing cleanup in test_mksession.vim (9.2.0782).
    • tests: personal spell files leak into later tests (9.2.0783).
    • crash when borrowing statusline highlight in silent Ex mode (9.2.0784).
    • WinResized not triggered when the whole Vim is resized (9.2.0785).
    • filetype: containerfile is not recognized (9.2.0786).
    • regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).
    • filetype: hip files are not recognized (9.2.0788).
    • 'statuslineopt' status line too high after a window is minimized (9.2.0789).
    • 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).
    • wincol() counts from right side for 'rightleft' (9.2.0791).
    • runtime(netrw): explore without optional dir broken (9.2.0792).
    • if session restored a tiny window, restore fails (9.2.0793).
    • extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).
    • popup menu shadow is not cleared when the menu shrinks (9.2.0795).
    • Visual block reselection wrong with 'virtualedit' (9.2.0796).
    • memory leak in get_qfline_items() on alloc failure (9.2.0797).
    • memory leak in compile_expr6() on alloc failure (9.2.0798).
    • memory leak in compile_def_function_body() on alloc failure (9.2.0799).
    • memory leak in call_func() on alloc failure (9.2.0800).
    • memory leak in f_getreginfo() on alloc failure (9.2.0801).
    • memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).
    • memory leak on alloc failure with taglist/gettagstack() (9.2.0803).
    • wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).
    • screenpos() "curscol" is wrong with 'rightleft' (9.2.0805).
    • 'showcmd' may show internal command keys (9.2.0806).
    • MS-Windows: ellipsis character is garbled (9.2.0807).
    • getregionpos: double-free on alloc failure (9.2.0808).
    • getframelayout() uses wrong function to free lists (9.2.0809).
    • add_llist_tags() uses wrong function to free dict (9.2.0810).
    • mksession writes terminal command unquoted (9.2.0811).
    • :argdelete with pattern leads to wrong argidx() (9.2.0812).
    • dict_add_func() may corrupt funcref count on failure (9.2.0813).
    • Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).
    • deeply nested regexp patterns may cause stack overflow (9.2.0815).
    • GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).
    • crash when building a stacktrace during an autocommand (9.2.0817).
    • tests: client-server test fails without X11 server (9.2.0818).
    • MS-Windows: sixel image shown as raw text in the console (9.2.0819).
    • GUI: hidden popup image is displayed and not erased (9.2.0820).
    • filetype: msmtp system-wide rc file not detected (9.2.0821).
    • GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).
    • tests: Test_clientserver_servlist_list may fail (9.2.0823).
    • Makefile: make tags depends on configure (9.2.0824).
    • regexp:…
Record
SUSE-SU-2026:23391-1
Updated
2026-11-02
OSVSUSE-SU-2026:23393-1 No score

Security update for vim

This update for vim fixes the following issues:

Updated to version 9.2.0957.

Security issues fixed:

  • CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).
  • CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).
  • CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution (bsc#1275016).
  • CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution (bsc#1275015).
  • CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).
  • CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).
  • CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).
  • CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).

Other updates and bugfixes:

  • Version 9.2.0957.
    • tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).
    • tests: missing cleanup in test_mksession.vim (9.2.0782).
    • tests: personal spell files leak into later tests (9.2.0783).
    • crash when borrowing statusline highlight in silent Ex mode (9.2.0784).
    • WinResized not triggered when the whole Vim is resized (9.2.0785).
    • filetype: containerfile is not recognized (9.2.0786).
    • regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).
    • filetype: hip files are not recognized (9.2.0788).
    • 'statuslineopt' status line too high after a window is minimized (9.2.0789).
    • 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).
    • wincol() counts from right side for 'rightleft' (9.2.0791).
    • runtime(netrw): explore without optional dir broken (9.2.0792).
    • if session restored a tiny window, restore fails (9.2.0793).
    • extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).
    • popup menu shadow is not cleared when the menu shrinks (9.2.0795).
    • Visual block reselection wrong with 'virtualedit' (9.2.0796).
    • memory leak in get_qfline_items() on alloc failure (9.2.0797).
    • memory leak in compile_expr6() on alloc failure (9.2.0798).
    • memory leak in compile_def_function_body() on alloc failure (9.2.0799).
    • memory leak in call_func() on alloc failure (9.2.0800).
    • memory leak in f_getreginfo() on alloc failure (9.2.0801).
    • memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).
    • memory leak on alloc failure with taglist/gettagstack() (9.2.0803).
    • wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).
    • screenpos() "curscol" is wrong with 'rightleft' (9.2.0805).
    • 'showcmd' may show internal command keys (9.2.0806).
    • MS-Windows: ellipsis character is garbled (9.2.0807).
    • getregionpos: double-free on alloc failure (9.2.0808).
    • getframelayout() uses wrong function to free lists (9.2.0809).
    • add_llist_tags() uses wrong function to free dict (9.2.0810).
    • mksession writes terminal command unquoted (9.2.0811).
    • :argdelete with pattern leads to wrong argidx() (9.2.0812).
    • dict_add_func() may corrupt funcref count on failure (9.2.0813).
    • Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).
    • deeply nested regexp patterns may cause stack overflow (9.2.0815).
    • GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).
    • crash when building a stacktrace during an autocommand (9.2.0817).
    • tests: client-server test fails without X11 server (9.2.0818).
    • MS-Windows: sixel image shown as raw text in the console (9.2.0819).
    • GUI: hidden popup image is displayed and not erased (9.2.0820).
    • filetype: msmtp system-wide rc file not detected (9.2.0821).
    • GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).
    • tests: Test_clientserver_servlist_list may fail (9.2.0823).
    • Makefile: make tags depends on configure (9.2.0824).
    • regexp:…
Record
SUSE-SU-2026:23393-1
Updated
2026-11-02
OSVSUSE-SU-2026:23552-1 No score

Security update for vim

This update for vim fixes the following issues:

Updated to version 9.2.0957.

Security issues fixed:

  • CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).
  • CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).
  • CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution (bsc#1275016).
  • CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution (bsc#1275015).
  • CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).
  • CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).
  • CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).
  • CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).

Other updates and bugfixes:

  • Version 9.2.0957.
    • tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).
    • tests: missing cleanup in test_mksession.vim (9.2.0782).
    • tests: personal spell files leak into later tests (9.2.0783).
    • crash when borrowing statusline highlight in silent Ex mode (9.2.0784).
    • WinResized not triggered when the whole Vim is resized (9.2.0785).
    • filetype: containerfile is not recognized (9.2.0786).
    • regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).
    • filetype: hip files are not recognized (9.2.0788).
    • 'statuslineopt' status line too high after a window is minimized (9.2.0789).
    • 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).
    • wincol() counts from right side for 'rightleft' (9.2.0791).
    • runtime(netrw): explore without optional dir broken (9.2.0792).
    • if session restored a tiny window, restore fails (9.2.0793).
    • extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).
    • popup menu shadow is not cleared when the menu shrinks (9.2.0795).
    • Visual block reselection wrong with 'virtualedit' (9.2.0796).
    • memory leak in get_qfline_items() on alloc failure (9.2.0797).
    • memory leak in compile_expr6() on alloc failure (9.2.0798).
    • memory leak in compile_def_function_body() on alloc failure (9.2.0799).
    • memory leak in call_func() on alloc failure (9.2.0800).
    • memory leak in f_getreginfo() on alloc failure (9.2.0801).
    • memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).
    • memory leak on alloc failure with taglist/gettagstack() (9.2.0803).
    • wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).
    • screenpos() "curscol" is wrong with 'rightleft' (9.2.0805).
    • 'showcmd' may show internal command keys (9.2.0806).
    • MS-Windows: ellipsis character is garbled (9.2.0807).
    • getregionpos: double-free on alloc failure (9.2.0808).
    • getframelayout() uses wrong function to free lists (9.2.0809).
    • add_llist_tags() uses wrong function to free dict (9.2.0810).
    • mksession writes terminal command unquoted (9.2.0811).
    • :argdelete with pattern leads to wrong argidx() (9.2.0812).
    • dict_add_func() may corrupt funcref count on failure (9.2.0813).
    • Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).
    • deeply nested regexp patterns may cause stack overflow (9.2.0815).
    • GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).
    • crash when building a stacktrace during an autocommand (9.2.0817).
    • tests: client-server test fails without X11 server (9.2.0818).
    • MS-Windows: sixel image shown as raw text in the console (9.2.0819).
    • GUI: hidden popup image is displayed and not erased (9.2.0820).
    • filetype: msmtp system-wide rc file not detected (9.2.0821).
    • GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).
    • tests: Test_clientserver_servlist_list may fail (9.2.0823).
    • Makefile: make tags depends on configure (9.2.0824).
    • regexp:…
Record
SUSE-SU-2026:23552-1
Updated
2026-11-02
OSVSUSE-SU-2026:3677-1 No score

Security update for vim

This update for vim fixes the following issues:

  • CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).
  • CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).
  • CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution (bsc#1275016).
  • CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution (bsc#1275015).
  • CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).
  • CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).
  • CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).
  • CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).

Changes for vim:

  • Updated to version 9.2.0957.
  • tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).
  • tests: missing cleanup in test_mksession.vim (9.2.0782).
  • tests: personal spell files leak into later tests (9.2.0783).
  • crash when borrowing statusline highlight in silent Ex mode (9.2.0784).
  • WinResized not triggered when the whole Vim is resized (9.2.0785).
  • filetype: containerfile is not recognized (9.2.0786).
  • regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).
  • filetype: hip files are not recognized (9.2.0788).
  • 'statuslineopt' status line too high after a window is minimized (9.2.0789).
  • 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).
  • wincol() counts from right side for 'rightleft' (9.2.0791).
  • runtime(netrw): explore without optional dir broken (9.2.0792).
  • if session restored a tiny window, restore fails (9.2.0793).
  • extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).
  • popup menu shadow is not cleared when the menu shrinks (9.2.0795).
  • Visual block reselection wrong with 'virtualedit' (9.2.0796).
  • memory leak in get_qfline_items() on alloc failure (9.2.0797).
  • memory leak in compile_expr6() on alloc failure (9.2.0798).
  • memory leak in compile_def_function_body() on alloc failure (9.2.0799).
  • memory leak in call_func() on alloc failure (9.2.0800).
  • memory leak in f_getreginfo() on alloc failure (9.2.0801).
  • memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).
  • memory leak on alloc failure with taglist/gettagstack() (9.2.0803).
  • wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).
  • screenpos() 'curscol' is wrong with 'rightleft' (9.2.0805).
  • 'showcmd' may show internal command keys (9.2.0806).
  • MS-Windows: ellipsis character is garbled (9.2.0807).
  • getregionpos: double-free on alloc failure (9.2.0808).
  • getframelayout() uses wrong function to free lists (9.2.0809).
  • add_llist_tags() uses wrong function to free dict (9.2.0810).
  • mksession writes terminal command unquoted (9.2.0811).
  • :argdelete with pattern leads to wrong argidx() (9.2.0812).
  • dict_add_func() may corrupt funcref count on failure (9.2.0813).
  • Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).
  • deeply nested regexp patterns may cause stack overflow (9.2.0815).
  • GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).
  • crash when building a stacktrace during an autocommand (9.2.0817).
  • tests: client-server test fails without X11 server (9.2.0818).
  • MS-Windows: sixel image shown as raw text in the console (9.2.0819).
  • GUI: hidden popup image is displayed and not erased (9.2.0820).
  • filetype: msmtp system-wide rc file not detected (9.2.0821).
  • GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).
  • tests: Test_clientserver_servlist_list may fail (9.2.0823).
  • Makefile: make tags depends on configure (9.2.0824).
  • regexp: submatch in a look-behind is empty with the NFA engine (9.2.0825).
  • highlighting for broken…
Record
SUSE-SU-2026:3677-1
Updated
2026-11-02
OSVSUSE-SU-2026:3679-1 No score

Security update for vim

This update for vim fixes the following issues:

  • CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).
  • CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).
  • CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution (bsc#1275016).
  • CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution (bsc#1275015).
  • CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).
  • CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).
  • CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).
  • CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).

Changes for vim:

  • Updated to version 9.2.0957.
  • tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).
  • tests: missing cleanup in test_mksession.vim (9.2.0782).
  • tests: personal spell files leak into later tests (9.2.0783).
  • crash when borrowing statusline highlight in silent Ex mode (9.2.0784).
  • WinResized not triggered when the whole Vim is resized (9.2.0785).
  • filetype: containerfile is not recognized (9.2.0786).
  • regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).
  • filetype: hip files are not recognized (9.2.0788).
  • 'statuslineopt' status line too high after a window is minimized (9.2.0789).
  • 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).
  • wincol() counts from right side for 'rightleft' (9.2.0791).
  • runtime(netrw): explore without optional dir broken (9.2.0792).
  • if session restored a tiny window, restore fails (9.2.0793).
  • extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).
  • popup menu shadow is not cleared when the menu shrinks (9.2.0795).
  • Visual block reselection wrong with 'virtualedit' (9.2.0796).
  • memory leak in get_qfline_items() on alloc failure (9.2.0797).
  • memory leak in compile_expr6() on alloc failure (9.2.0798).
  • memory leak in compile_def_function_body() on alloc failure (9.2.0799).
  • memory leak in call_func() on alloc failure (9.2.0800).
  • memory leak in f_getreginfo() on alloc failure (9.2.0801).
  • memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).
  • memory leak on alloc failure with taglist/gettagstack() (9.2.0803).
  • wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).
  • screenpos() 'curscol' is wrong with 'rightleft' (9.2.0805).
  • 'showcmd' may show internal command keys (9.2.0806).
  • MS-Windows: ellipsis character is garbled (9.2.0807).
  • getregionpos: double-free on alloc failure (9.2.0808).
  • getframelayout() uses wrong function to free lists (9.2.0809).
  • add_llist_tags() uses wrong function to free dict (9.2.0810).
  • mksession writes terminal command unquoted (9.2.0811).
  • :argdelete with pattern leads to wrong argidx() (9.2.0812).
  • dict_add_func() may corrupt funcref count on failure (9.2.0813).
  • Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).
  • deeply nested regexp patterns may cause stack overflow (9.2.0815).
  • GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).
  • crash when building a stacktrace during an autocommand (9.2.0817).
  • tests: client-server test fails without X11 server (9.2.0818).
  • MS-Windows: sixel image shown as raw text in the console (9.2.0819).
  • GUI: hidden popup image is displayed and not erased (9.2.0820).
  • filetype: msmtp system-wide rc file not detected (9.2.0821).
  • GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).
  • tests: Test_clientserver_servlist_list may fail (9.2.0823).
  • Makefile: make tags depends on configure (9.2.0824).
  • regexp: submatch in a look-behind is empty with the NFA engine (9.2.0825).
  • highlighting for broken…
Record
SUSE-SU-2026:3679-1
Updated
2026-11-02
OSVSUSE-SU-2026:3680-1 No score

Security update for vim

This update for vim fixes the following issues:

  • CVE-2026-73070: stack buffer overflow in the socket server can lead to denial of service (bsc#1275018).
  • CVE-2026-73071: use-after-free in JSON decoding can lead to process crash (bsc#1275017).
  • CVE-2026-73072: heap buffer overflow when loading a spell file can lead to crash or potential code execution (bsc#1275016).
  • CVE-2026-73074: heap buffer overflow in text property handling can lead to a crash or potential code execution (bsc#1275015).
  • CVE-2026-73075: out-of-bounds access in popup opacity handling can lead to a conditional memory write (bsc#1275014).
  • CVE-2026-73076: arbitrary command execution via the vimball record file (bsc#1275013).
  • CVE-2026-73077: arbitrary code execution due to insecure shell command handling (bsc#1275012).
  • CVE-2026-73078: arbitrary code execution via crafted netrw menu entries (bsc#1275011).

Changes for vim:

  • Updated to version 9.2.0957.
  • tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir (9.2.0781).
  • tests: missing cleanup in test_mksession.vim (9.2.0782).
  • tests: personal spell files leak into later tests (9.2.0783).
  • crash when borrowing statusline highlight in silent Ex mode (9.2.0784).
  • WinResized not triggered when the whole Vim is resized (9.2.0785).
  • filetype: containerfile is not recognized (9.2.0786).
  • regexp: code 0x1ecb duplicated for equivalence class (9.2.0787).
  • filetype: hip files are not recognized (9.2.0788).
  • 'statuslineopt' status line too high after a window is minimized (9.2.0789).
  • 'completeslash' breaks :find completion with 'findfunc' (9.2.0790).
  • wincol() counts from right side for 'rightleft' (9.2.0791).
  • runtime(netrw): explore without optional dir broken (9.2.0792).
  • if session restored a tiny window, restore fails (9.2.0793).
  • extend() and extendnew() don't handle NULL expr2 properly (9.2.0794).
  • popup menu shadow is not cleared when the menu shrinks (9.2.0795).
  • Visual block reselection wrong with 'virtualedit' (9.2.0796).
  • memory leak in get_qfline_items() on alloc failure (9.2.0797).
  • memory leak in compile_expr6() on alloc failure (9.2.0798).
  • memory leak in compile_def_function_body() on alloc failure (9.2.0799).
  • memory leak in call_func() on alloc failure (9.2.0800).
  • memory leak in f_getreginfo() on alloc failure (9.2.0801).
  • memory leak with list_append_dict/dict_add_list on alloc failure (9.2.0802).
  • memory leak on alloc failure with taglist/gettagstack() (9.2.0803).
  • wincol() is wrong for a double-wide character with 'rightleft' (9.2.0804).
  • screenpos() 'curscol' is wrong with 'rightleft' (9.2.0805).
  • 'showcmd' may show internal command keys (9.2.0806).
  • MS-Windows: ellipsis character is garbled (9.2.0807).
  • getregionpos: double-free on alloc failure (9.2.0808).
  • getframelayout() uses wrong function to free lists (9.2.0809).
  • add_llist_tags() uses wrong function to free dict (9.2.0810).
  • mksession writes terminal command unquoted (9.2.0811).
  • :argdelete with pattern leads to wrong argidx() (9.2.0812).
  • dict_add_func() may corrupt funcref count on failure (9.2.0813).
  • Vim9: E1041 when reloading an autoload script with exported variables (9.2.0814).
  • deeply nested regexp patterns may cause stack overflow (9.2.0815).
  • GTK4: memory leak in gui_gtk_set_dnd_targets() (9.2.0816).
  • crash when building a stacktrace during an autocommand (9.2.0817).
  • tests: client-server test fails without X11 server (9.2.0818).
  • MS-Windows: sixel image shown as raw text in the console (9.2.0819).
  • GUI: hidden popup image is displayed and not erased (9.2.0820).
  • filetype: msmtp system-wide rc file not detected (9.2.0821).
  • GTK4: crash menu id is null in gui_mch_destroy_menu() (9.2.0822).
  • tests: Test_clientserver_servlist_list may fail (9.2.0823).
  • Makefile: make tags depends on configure (9.2.0824).
  • regexp: submatch in a look-behind is empty with the NFA engine (9.2.0825).
  • highlighting for broken…
Record
SUSE-SU-2026:3680-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
vim
Alpine:v3.23
 9.2.0469 up to 9.2.0854-r0
9.2.0854-r0
vim
Alpine:v3.24
 9.2.0469 up to 9.2.0843-r0
9.2.0843-r0
vim
Azure Linux:3
 before 9.2.0957-1
9.2.0957-1
vim
Alpaquita:23
 9.0.0820-r2 up to 9.2.0854-r0
9.2.0854-r0
vim
Alpaquita:25
 9.1.1415-r0 up to 9.2.0854-r0
9.2.0854-r0
vim
Alpaquita:stream
 9.0.1395-r0 up to 9.2.0854-r0
9.2.0854-r0
vim
Debian:14
 before 2:9.2.0858-1, plus listed versions
2:9.1.1230-22:9.1.1385-12:9.1.1766-12:9.1.1829-12:9.1.1846-1
Show 13 moreShow less
2:9.1.1882-12:9.1.2103-12:9.1.2141-12:9.2.0119-12:9.2.0136-12:9.2.0218-12:9.2.0315-12:9.2.0338-12:9.2.0355-12:9.2.0428-12:9.2.0461-12:9.2.0524-12:9.2.0782-1
2:9.2.0858-1
vim
Mageia:10
From an advisory covering 9 CVEs
 before 9.2.1011-2.mga10
9.2.1011-2.mga10
vim
Mageia:9
From an advisory covering 9 CVEs
 before 9.2.1011-2.mga9
9.2.1011-2.mga9
vim
SUSE:Linux Micro 6.1
From an advisory covering 8 CVEs
 before 9.2.0957-slfo.1.1_1.1
9.2.0957-slfo.1.1_1.1
Show 19 moreShow less
Affected packages
PackageAffectedFixed
vim
SUSE:Linux Micro 6.0
From an advisory covering 8 CVEs
 before 9.2.0957-1.1
9.2.0957-1.1
vim
SUSE:Linux Micro Extras 6.2
From an advisory covering 8 CVEs
 before 9.2.0957-160000.1.1
9.2.0957-160000.1.1
vim
SUSE:Linux Micro 6.2
From an advisory covering 8 CVEs
 before 9.2.0957-160000.1.1
9.2.0957-160000.1.1
vim
SUSE:Linux Enterprise Server 16.0
From an advisory covering 8 CVEs
 before 9.2.0957-160000.1.1
9.2.0957-160000.1.1
vim
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 8 CVEs
 before 9.2.0957-160000.1.1
9.2.0957-160000.1.1
vim
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 8 CVEs
 before 9.2.0957-17.76.1
9.2.0957-17.76.1
vim
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 8 CVEs
 before 9.2.0957-17.76.1
9.2.0957-17.76.1
vim
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 8 CVEs
 before 9.2.0957-150000.5.102.1
9.2.0957-150000.5.102.1
vim
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 8 CVEs
 before 9.2.0957-150000.5.102.1
9.2.0957-150000.5.102.1
vim
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 8 CVEs
 before 9.2.0957-150500.20.64.1
9.2.0957-150500.20.64.1
vim
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 8 CVEs
 before 9.2.0957-150500.20.64.1
9.2.0957-150500.20.64.1
vim
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
From an advisory covering 8 CVEs
 before 9.2.0957-150500.20.64.1
9.2.0957-150500.20.64.1
vim
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 8 CVEs
 before 9.2.0957-150500.20.64.1
9.2.0957-150500.20.64.1
vim
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 8 CVEs
 before 9.2.0957-150500.20.64.1
9.2.0957-150500.20.64.1
vim
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 8 CVEs
 before 9.2.0957-150500.20.64.1
9.2.0957-150500.20.64.1
vim
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 8 CVEs
 before 9.2.0957-150500.20.64.1
9.2.0957-150500.20.64.1
vim
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 8 CVEs
 before 9.2.0957-150500.20.64.1
9.2.0957-150500.20.64.1
vim
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 8 CVEs
 before 9.2.0957-150500.20.64.1
9.2.0957-150500.20.64.1
vim
openSUSE:Leap 16.0
From an advisory covering 8 CVEs
 before 9.2.0957-160000.1.1
9.2.0957-160000.1.1

History

History
RecordedChangedSources
affected, facts
affectedOSV
affected
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-73075 is a medium vulnerability (CVSS 4.6) in Vim, published August 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.09%, the 0th percentile. Fixed in vim 9.2.0854-r0.

References

Show 49 moreShow less
This page doesn't list everything

Left out here: the rest of 9 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open