{"id":"CVE-2026-57452","aliases":["ALPINE-CVE-2026-57452","AZL-91098","BELL-CVE-2026-57452","DEBIAN-CVE-2026-57452","EUVD-2026-39448","GHSA-c4j9-wr9j-4486","MGASA-2026-0240","OESA-2026-3027","RHSA-2026:30267","UBUNTU-CVE-2026-57452","USN-8500-1"],"status":"published","title":"Vim: Out-of-bounds Read with libsodium-encrypted Files","description":"Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05!\nmethod (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is fixed in 9.2.0671.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0017,"percentile":0.06481,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-191"],"published":"2026-06-25T15:27:50Z","modified":"2026-11-03T06:32:56Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"vim","fixed_in":["9.2.0854-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"vim","fixed_in":["9.2.0677-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"vim","fixed_in":["9.2.0735-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"vim","fixed_in":["9.2.0747-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"vim","fixed_in":["9.2.0747-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"vim","fixed_in":["9.2.0699-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"vim","fixed_in":["2:9.1.1230-2+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"vim","fixed_in":["2:9.2.0782-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"vim","fixed_in":["2:8.2.3995-1ubuntu2.33"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"vim","fixed_in":["2:9.1.0016-1ubuntu7.17"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"vim","fixed_in":["2:9.1.0967-1ubuntu6.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"vim","fixed_in":["2:9.1.2141-1ubuntu4.6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0854-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0677-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.0735-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0820-r2"},{"fixed":"9.2.0747-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1.1415-r0"},{"fixed":"9.2.0747-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.1395-r0"},{"fixed":"9.2.0699-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:9.0.1378-2","2:9.0.1378-2+deb12u1","2:9.0.1378-2+deb12u2","2:9.0.1658-1","2:9.0.1672-1","2:9.0.1894-1","2:9.0.2018-1","2:9.0.2087-1","2:9.0.2103-1","2:9.0.2116-1","2:9.0.2189-1","2:9.1.0-1","2:9.1.0016-1","2:9.1.0199-1","2:9.1.0374-1","2:9.1.0377-1","2:9.1.0496-1","2:9.1.0698-1","2:9.1.0709-1","2:9.1.0709-2","2:9.1.0777-1","2:9.1.0861-1","2:9.1.0967-1","2:9.1.0967-2","2:9.1.1113-1","2:9.1.1230-1","2:9.1.1230-2","2:9.1.1385-1","2:9.1.1766-1","2:9.1.1829-1","2:9.1.1846-1","2:9.1.1882-1","2:9.1.2103-1","2:9.1.2141-1","2:9.2.0119-1","2:9.2.0136-1","2:9.2.0218-1","2:9.2.0315-1","2:9.2.0338-1","2:9.2.0355-1","2:9.2.0428-1","2:9.2.0461-1","2:9.2.0524-1","2:9.2.0782-1","2:9.2.0858-1"]},{"source":"osv","ecosystem":"Debian:13","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.1230-2+deb13u1"}]}],"versions":["2:9.1.1230-2"]},{"source":"osv","ecosystem":"Debian:14","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.2.0782-1"}]}],"versions":["2:9.1.1230-2","2:9.1.1385-1","2:9.1.1766-1","2:9.1.1829-1","2:9.1.1846-1","2:9.1.1882-1","2:9.1.2103-1","2:9.1.2141-1","2:9.2.0119-1","2:9.2.0136-1","2:9.2.0218-1","2:9.2.0315-1","2:9.2.0338-1","2:9.2.0355-1","2:9.2.0428-1","2:9.2.0461-1","2:9.2.0524-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.782-1.mga10"}]}],"bundled":12},{"source":"osv","ecosystem":"Mageia:9","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.782-1.mga9"}]}],"bundled":12},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2092-38.oe2403sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0-52.oe2003sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0-52.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2092-38.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2092-38.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.725-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"vim-X11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.725-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"vim-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.725-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"vim-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.725-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"vim-default-editor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.725-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"vim-enhanced","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.725-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"vim-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.725-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"vim-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.725-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"xxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.2.725-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.3995-1ubuntu2.33"}]}],"versions":["2:8.2.2434-3ubuntu3","2:8.2.2434-3ubuntu4","2:8.2.3565-1ubuntu1","2:8.2.3565-1ubuntu2","2:8.2.3565-1ubuntu3","2:8.2.3565-1ubuntu5","2:8.2.3995-1ubuntu1","2:8.2.3995-1ubuntu2","2:8.2.3995-1ubuntu2.1","2:8.2.3995-1ubuntu2.3","2:8.2.3995-1ubuntu2.4","2:8.2.3995-1ubuntu2.5","2:8.2.3995-1ubuntu2.7","2:8.2.3995-1ubuntu2.8","2:8.2.3995-1ubuntu2.9","2:8.2.3995-1ubuntu2.10","2:8.2.3995-1ubuntu2.11","2:8.2.3995-1ubuntu2.12","2:8.2.3995-1ubuntu2.13","2:8.2.3995-1ubuntu2.15","2:8.2.3995-1ubuntu2.16","2:8.2.3995-1ubuntu2.17","2:8.2.3995-1ubuntu2.18","2:8.2.3995-1ubuntu2.19","2:8.2.3995-1ubuntu2.20","2:8.2.3995-1ubuntu2.21","2:8.2.3995-1ubuntu2.22","2:8.2.3995-1ubuntu2.23","2:8.2.3995-1ubuntu2.24","2:8.2.3995-1ubuntu2.26","2:8.2.3995-1ubuntu2.27","2:8.2.3995-1ubuntu2.28","2:8.2.3995-1ubuntu2.29","2:8.2.3995-1ubuntu2.30","2:8.2.3995-1ubuntu2.31","2:8.2.3995-1ubuntu2.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.0016-1ubuntu7.17"}]}],"versions":["2:9.0.1672-1ubuntu2","2:9.0.2087-1ubuntu1","2:9.0.2116-1ubuntu1","2:9.0.2116-1ubuntu2","2:9.0.2184-0ubuntu1","2:9.0.2189-1ubuntu1","2:9.1.0-1ubuntu1","2:9.1.0016-1ubuntu2","2:9.1.0016-1ubuntu6","2:9.1.0016-1ubuntu7","2:9.1.0016-1ubuntu7.1","2:9.1.0016-1ubuntu7.2","2:9.1.0016-1ubuntu7.3","2:9.1.0016-1ubuntu7.4","2:9.1.0016-1ubuntu7.5","2:9.1.0016-1ubuntu7.6","2:9.1.0016-1ubuntu7.7","2:9.1.0016-1ubuntu7.8","2:9.1.0016-1ubuntu7.9","2:9.1.0016-1ubuntu7.10","2:9.1.0016-1ubuntu7.11","2:9.1.0016-1ubuntu7.12","2:9.1.0016-1ubuntu7.13","2:9.1.0016-1ubuntu7.14","2:9.1.0016-1ubuntu7.15","2:9.1.0016-1ubuntu7.16"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.0967-1ubuntu6.8"}]}],"versions":["2:9.1.0967-1ubuntu4","2:9.1.0967-1ubuntu5","2:9.1.0967-1ubuntu6","2:9.1.0967-1ubuntu6.1","2:9.1.0967-1ubuntu6.2","2:9.1.0967-1ubuntu6.3","2:9.1.0967-1ubuntu6.4","2:9.1.0967-1ubuntu6.5","2:9.1.0967-1ubuntu6.6","2:9.1.0967-1ubuntu6.7"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.2141-1ubuntu4.6"}]}],"versions":["2:9.1.0967-1ubuntu6","2:9.1.1882-1ubuntu1","2:9.1.1882-1ubuntu2","2:9.1.2141-1ubuntu1","2:9.1.2141-1ubuntu2","2:9.1.2141-1ubuntu4","2:9.1.2141-1ubuntu4.1","2:9.1.2141-1ubuntu4.2","2:9.1.2141-1ubuntu4.3","2:9.1.2141-1ubuntu4.5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.052-1ubuntu3.1+esm30"}]}],"versions":["2:7.4.000-1ubuntu2","2:7.4.052-1ubuntu1","2:7.4.052-1ubuntu2","2:7.4.052-1ubuntu3","2:7.4.052-1ubuntu3.1","2:7.4.052-1ubuntu3.1+esm1","2:7.4.052-1ubuntu3.1+esm3","2:7.4.052-1ubuntu3.1+esm4","2:7.4.052-1ubuntu3.1+esm5","2:7.4.052-1ubuntu3.1+esm6","2:7.4.052-1ubuntu3.1+esm7","2:7.4.052-1ubuntu3.1+esm8","2:7.4.052-1ubuntu3.1+esm9","2:7.4.052-1ubuntu3.1+esm10","2:7.4.052-1ubuntu3.1+esm11","2:7.4.052-1ubuntu3.1+esm12","2:7.4.052-1ubuntu3.1+esm13","2:7.4.052-1ubuntu3.1+esm14","2:7.4.052-1ubuntu3.1+esm15","2:7.4.052-1ubuntu3.1+esm16","2:7.4.052-1ubuntu3.1+esm17","2:7.4.052-1ubuntu3.1+esm18","2:7.4.052-1ubuntu3.1+esm19","2:7.4.052-1ubuntu3.1+esm20","2:7.4.052-1ubuntu3.1+esm21","2:7.4.052-1ubuntu3.1+esm22","2:7.4.052-1ubuntu3.1+esm23","2:7.4.052-1ubuntu3.1+esm24","2:7.4.052-1ubuntu3.1+esm25","2:7.4.052-1ubuntu3.1+esm26","2:7.4.052-1ubuntu3.1+esm27","2:7.4.052-1ubuntu3.1+esm28","2:7.4.052-1ubuntu3.1+esm29"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.4.1689-3ubuntu1.5+esm36"}]}],"versions":["2:7.4.712-2ubuntu4","2:7.4.826-1ubuntu1","2:7.4.826-1ubuntu2","2:7.4.826-1ubuntu3","2:7.4.963-1ubuntu1","2:7.4.963-1ubuntu4","2:7.4.963-1ubuntu5","2:7.4.1689-3ubuntu1","2:7.4.1689-3ubuntu1.1","2:7.4.1689-3ubuntu1.2","2:7.4.1689-3ubuntu1.3","2:7.4.1689-3ubuntu1.4","2:7.4.1689-3ubuntu1.5","2:7.4.1689-3ubuntu1.5+esm2","2:7.4.1689-3ubuntu1.5+esm3","2:7.4.1689-3ubuntu1.5+esm4","2:7.4.1689-3ubuntu1.5+esm5","2:7.4.1689-3ubuntu1.5+esm6","2:7.4.1689-3ubuntu1.5+esm7","2:7.4.1689-3ubuntu1.5+esm8","2:7.4.1689-3ubuntu1.5+esm10","2:7.4.1689-3ubuntu1.5+esm11","2:7.4.1689-3ubuntu1.5+esm12","2:7.4.1689-3ubuntu1.5+esm13","2:7.4.1689-3ubuntu1.5+esm14","2:7.4.1689-3ubuntu1.5+esm15","2:7.4.1689-3ubuntu1.5+esm17","2:7.4.1689-3ubuntu1.5+esm18","2:7.4.1689-3ubuntu1.5+esm19","2:7.4.1689-3ubuntu1.5+esm20","2:7.4.1689-3ubuntu1.5+esm22","2:7.4.1689-3ubuntu1.5+esm23","2:7.4.1689-3ubuntu1.5+esm24","2:7.4.1689-3ubuntu1.5+esm25","2:7.4.1689-3ubuntu1.5+esm26","2:7.4.1689-3ubuntu1.5+esm27","2:7.4.1689-3ubuntu1.5+esm28","2:7.4.1689-3ubuntu1.5+esm29","2:7.4.1689-3ubuntu1.5+esm30","2:7.4.1689-3ubuntu1.5+esm31","2:7.4.1689-3ubuntu1.5+esm32","2:7.4.1689-3ubuntu1.5+esm33","2:7.4.1689-3ubuntu1.5+esm34","2:7.4.1689-3ubuntu1.5+esm35"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.0.1453-1ubuntu1.13+esm21"}]}],"versions":["2:8.0.0197-4ubuntu5","2:8.0.1144-1ubuntu1","2:8.0.1401-1ubuntu1","2:8.0.1401-1ubuntu2","2:8.0.1401-1ubuntu3","2:8.0.1453-1ubuntu1","2:8.0.1453-1ubuntu1.1","2:8.0.1453-1ubuntu1.3","2:8.0.1453-1ubuntu1.4","2:8.0.1453-1ubuntu1.6","2:8.0.1453-1ubuntu1.7","2:8.0.1453-1ubuntu1.8","2:8.0.1453-1ubuntu1.9","2:8.0.1453-1ubuntu1.10","2:8.0.1453-1ubuntu1.11","2:8.0.1453-1ubuntu1.12","2:8.0.1453-1ubuntu1.13","2:8.0.1453-1ubuntu1.13+esm1","2:8.0.1453-1ubuntu1.13+esm3","2:8.0.1453-1ubuntu1.13+esm4","2:8.0.1453-1ubuntu1.13+esm5","2:8.0.1453-1ubuntu1.13+esm6","2:8.0.1453-1ubuntu1.13+esm7","2:8.0.1453-1ubuntu1.13+esm8","2:8.0.1453-1ubuntu1.13+esm9","2:8.0.1453-1ubuntu1.13+esm10","2:8.0.1453-1ubuntu1.13+esm11","2:8.0.1453-1ubuntu1.13+esm12","2:8.0.1453-1ubuntu1.13+esm13","2:8.0.1453-1ubuntu1.13+esm14","2:8.0.1453-1ubuntu1.13+esm15","2:8.0.1453-1ubuntu1.13+esm16","2:8.0.1453-1ubuntu1.13+esm17","2:8.0.1453-1ubuntu1.13+esm18","2:8.0.1453-1ubuntu1.13+esm19","2:8.0.1453-1ubuntu1.13+esm20"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.1.2269-1ubuntu5.32+esm9"}]}],"versions":["2:8.1.0875-5ubuntu2","2:8.1.0875-5ubuntu3","2:8.1.0875-5ubuntu4","2:8.1.2269-1ubuntu1","2:8.1.2269-1ubuntu4","2:8.1.2269-1ubuntu5","2:8.1.2269-1ubuntu5.3","2:8.1.2269-1ubuntu5.4","2:8.1.2269-1ubuntu5.6","2:8.1.2269-1ubuntu5.7","2:8.1.2269-1ubuntu5.8","2:8.1.2269-1ubuntu5.9","2:8.1.2269-1ubuntu5.11","2:8.1.2269-1ubuntu5.12","2:8.1.2269-1ubuntu5.13","2:8.1.2269-1ubuntu5.14","2:8.1.2269-1ubuntu5.15","2:8.1.2269-1ubuntu5.16","2:8.1.2269-1ubuntu5.17","2:8.1.2269-1ubuntu5.18","2:8.1.2269-1ubuntu5.20","2:8.1.2269-1ubuntu5.21","2:8.1.2269-1ubuntu5.22","2:8.1.2269-1ubuntu5.23","2:8.1.2269-1ubuntu5.24","2:8.1.2269-1ubuntu5.25","2:8.1.2269-1ubuntu5.26","2:8.1.2269-1ubuntu5.29","2:8.1.2269-1ubuntu5.30","2:8.1.2269-1ubuntu5.31","2:8.1.2269-1ubuntu5.32","2:8.1.2269-1ubuntu5.32+esm2","2:8.1.2269-1ubuntu5.32+esm3","2:8.1.2269-1ubuntu5.32+esm4","2:8.1.2269-1ubuntu5.32+esm5","2:8.1.2269-1ubuntu5.32+esm6","2:8.1.2269-1ubuntu5.32+esm7","2:8.1.2269-1ubuntu5.32+esm8"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:8.2.3995-1ubuntu2.33"}]}],"versions":["2:8.2.2434-3ubuntu3","2:8.2.2434-3ubuntu4","2:8.2.3565-1ubuntu1","2:8.2.3565-1ubuntu2","2:8.2.3565-1ubuntu3","2:8.2.3565-1ubuntu5","2:8.2.3995-1ubuntu1","2:8.2.3995-1ubuntu2","2:8.2.3995-1ubuntu2.1","2:8.2.3995-1ubuntu2.3","2:8.2.3995-1ubuntu2.4","2:8.2.3995-1ubuntu2.5","2:8.2.3995-1ubuntu2.7","2:8.2.3995-1ubuntu2.8","2:8.2.3995-1ubuntu2.9","2:8.2.3995-1ubuntu2.10","2:8.2.3995-1ubuntu2.11","2:8.2.3995-1ubuntu2.12","2:8.2.3995-1ubuntu2.13","2:8.2.3995-1ubuntu2.15","2:8.2.3995-1ubuntu2.16","2:8.2.3995-1ubuntu2.17","2:8.2.3995-1ubuntu2.18","2:8.2.3995-1ubuntu2.19","2:8.2.3995-1ubuntu2.20","2:8.2.3995-1ubuntu2.21","2:8.2.3995-1ubuntu2.22","2:8.2.3995-1ubuntu2.23","2:8.2.3995-1ubuntu2.24","2:8.2.3995-1ubuntu2.26","2:8.2.3995-1ubuntu2.27","2:8.2.3995-1ubuntu2.28","2:8.2.3995-1ubuntu2.29","2:8.2.3995-1ubuntu2.30","2:8.2.3995-1ubuntu2.31","2:8.2.3995-1ubuntu2.32"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.0016-1ubuntu7.17"}]}],"versions":["2:9.0.1672-1ubuntu2","2:9.0.2087-1ubuntu1","2:9.0.2116-1ubuntu1","2:9.0.2116-1ubuntu2","2:9.0.2184-0ubuntu1","2:9.0.2189-1ubuntu1","2:9.1.0-1ubuntu1","2:9.1.0016-1ubuntu2","2:9.1.0016-1ubuntu6","2:9.1.0016-1ubuntu7","2:9.1.0016-1ubuntu7.1","2:9.1.0016-1ubuntu7.2","2:9.1.0016-1ubuntu7.3","2:9.1.0016-1ubuntu7.4","2:9.1.0016-1ubuntu7.5","2:9.1.0016-1ubuntu7.6","2:9.1.0016-1ubuntu7.7","2:9.1.0016-1ubuntu7.8","2:9.1.0016-1ubuntu7.9","2:9.1.0016-1ubuntu7.10","2:9.1.0016-1ubuntu7.11","2:9.1.0016-1ubuntu7.12","2:9.1.0016-1ubuntu7.13","2:9.1.0016-1ubuntu7.14","2:9.1.0016-1ubuntu7.15","2:9.1.0016-1ubuntu7.16"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.0967-1ubuntu6.8"}]}],"versions":["2:9.1.0967-1ubuntu4","2:9.1.0967-1ubuntu5","2:9.1.0967-1ubuntu6","2:9.1.0967-1ubuntu6.1","2:9.1.0967-1ubuntu6.2","2:9.1.0967-1ubuntu6.3","2:9.1.0967-1ubuntu6.4","2:9.1.0967-1ubuntu6.5","2:9.1.0967-1ubuntu6.6","2:9.1.0967-1ubuntu6.7"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.2141-1ubuntu4.6"}]}],"versions":["2:9.1.0967-1ubuntu6","2:9.1.1882-1ubuntu1","2:9.1.1882-1ubuntu2","2:9.1.2141-1ubuntu1","2:9.1.2141-1ubuntu2","2:9.1.2141-1ubuntu4","2:9.1.2141-1ubuntu4.1","2:9.1.2141-1ubuntu4.2","2:9.1.2141-1ubuntu4.3","2:9.1.2141-1ubuntu4.5"],"bundled":8}],"products":[{"vendor":"vim","product":"vim"}],"references":[{"url":"https://github.com/vim/vim/security/advisories/GHSA-c4j9-wr9j-4486","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","article","report"]},{"url":"https://github.com/vim/vim/commit/c8777cec25dcfae89c42e9aff51af61f71c5745f","tags":["x_refsource_MISC","Patch","fix","article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0671","tags":["x_refsource_MISC","Product","web","article"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-57452","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57452","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-57452","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57452.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-57452","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0240.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35580","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/22/13","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-3h95-3962-mmvf","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/29/5","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/30/4","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-47gw-8gc3-mgcm","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/04/14","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-65p9-mwwx-7468","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/15/8","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq","tags":["advisory","article"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/16/12","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-qm9w-fmpj-879h","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/16/13","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-vhh8-v6wx-hjjh","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/17/10","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-f36c-2qcp-7gpw","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/18/7","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/20/2","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-x5fg-h5w9-9frf","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/20/3","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-ww8h-47xp-hp4w","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/21/1","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4","tags":["advisory","article"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/21/2","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/24/9","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-m3hf-xcm3-xhm2","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/27/6","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-mf92-v4xw-j45x","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/28/1","tags":["web"]},{"url":"https://github.com/vim/vim/security/advisories/GHSA-fh26-8f79-wj97","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3027","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57455","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57456","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:30267","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55693","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-57455","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-57452","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_30267.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492980","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55693","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55693","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0653","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492979","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-57452","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492968","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-57455","tags":["advisory"]},{"url":"https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b","tags":["article"]},{"url":"https://github.com/vim/vim/releases/tag/v9.2.0698","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-57452","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8500-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-35177","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55693","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55892","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55895","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-57453","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-57455","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-57456","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-57452","title":"Vim: Out-of-bounds Read with libsodium-encrypted Files","description":"Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05!\nmethod (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is fixed in 9.2.0671.","status":"published","published":"2026-06-25T15:27:50.147Z","modified":"2026-06-25T15:47:18.346Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-125","CWE-191"],"updated_at":"2026-11-02T13:43:44.898272Z"}],"euvd":[{"id":"EUVD-2026-39448","description":"Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05!\nmethod (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is fixed in 9.2.0671.","status":"published","published":"2026-06-25T15:27:50Z","modified":"2026-06-25T15:47:18Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:20:25.700423Z"}],"nvd":[{"id":"CVE-2026-57452","description":"Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05!\nmethod (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is fixed in 9.2.0671.","status":"published","published":"2026-06-25T16:16:42.397Z","modified":"2026-06-26T04:12:32.483Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-125","CWE-191"],"updated_at":"2026-11-02T14:12:26.045561Z"}],"osv":[{"id":"ALPINE-CVE-2026-57452","description":"Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05!\nmethod (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is fixed in 9.2.0671.","status":"published","published":"2026-06-25T16:16:42.397Z","modified":"2026-11-03T06:32:56.559352175Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"BELL-CVE-2026-57452","status":"published","published":"2026-06-26T17:35:47.226899Z","modified":"2026-07-07T07:15:33.809233643Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"CVE-2026-57452","title":"Vim: Out-of-bounds Read with libsodium-encrypted Files","description":"Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05!\nmethod (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is fixed in 9.2.0671.","status":"published","published":"2026-06-25T15:27:50.147Z","modified":"2026-10-28T10:55:37.973273733Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125","CWE-191"],"updated_at":"2026-11-02T15:45:12.016252Z"},{"id":"DEBIAN-CVE-2026-57452","description":"Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05! method (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is fixed in 9.2.0671.","status":"published","published":"2026-06-25T16:16:42.397Z","modified":"2026-11-01T19:00:43.235145783Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"OESA-2026-3027","title":"vim security update","description":"Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor \u0026amp;apos;Vi\u0026amp;apos;, with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems.\r\n\r\nSecurity Fix(es):\n\nVim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05!\nmethod (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is fixed in 9.2.0671.(CVE-2026-57452)\n\nVim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of spell_soundfold_sofo() in src/spell.c translates a word through a spell file\u0026apos;s SOFO (sound-folding) byte map into a caller-owned result buffer. Its copy loop advances the output index ri with no upper bound and terminates only on the input NUL, writing one byte per input byte into the MAXWLEN-element stack buffer the caller provides. A word longer than MAXWLEN, passed to soundfold() (or reached via sound-based spell suggestion) while a SOFO-based spell language is active, therefore writes past the end of that buffer. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0698.(CVE-2026-57455)\n\nVim is an open source, command line text editor. Prior to 9.2.0699, Vim\u0026apos;s Python omni-completion (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. When reconstructing that source, each scope\u0026apos;s docstring is inserted verbatim between triple quotes with no escaping, so a hostile buffer can break out of the triple-quoted literal and execute attacker-controlled Python during omni-completion. This vulnerability is fixed in 9.2.0699.(CVE-2026-57456)","status":"published","published":"2026-07-19T11:11:55Z","modified":"2026-08-18T01:21:18.318715833Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:30267","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-02T10:16:35Z","modified":"2026-10-14T10:17:15Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"UBUNTU-CVE-2026-57452","description":"Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05! method (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is fixed in 9.2.0671.","status":"published","published":"2026-06-25T16:16:00Z","modified":"2026-07-02T22:49:57.06114711Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"AZL-91098","title":"CVE-2026-57452 affecting package vim for versions less than 9.2.0735-1","description":"Vim is an open source, command line text editor. Prior to 9.2.0671, when Vim opens a file encrypted with the VimCrypt~04! or VimCrypt~05!\nmethod (xchacha20poly1305, requires the +sodium feature) whose body is shorter than a single libsodium secretstream header, an unsigned length calculation underflows and a subsequent decryption call reads far past the end of the input buffer, crashing Vim. This vulnerability is fixed in 9.2.0671.","status":"published","published":"2026-06-25T16:16:42Z","modified":"2026-08-28T17:56:55.824428Z","updated_at":"2026-11-02T15:28:11.397546Z"},{"id":"MGASA-2026-0240","title":"Updated vim packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities:\nArbitrary Code Execution via Python Omni-Completion in Vim \u003c 9.2.0561.\n(CVE-2026-52858)\nOut-of-bounds Read in Terminal Screen Snapshot in Vim \u003c 9.2.0565.\n(CVE-2026-52859)\nArbitrary Code Execution via Python Omni-Completion in Vim \u003c 9.2.0597.\n(CVE-2026-52860)\nOut-of-bounds Write in Spell File Word Count in Vim \u003c 9.2.0653.\n(CVE-2026-55693)\nOut-of-bounds Write in Spell File Prefix Dump in Vim \u003c 9.2.0662.\n(CVE-2026-55892)\nVimscript Code Injection in netrw NetrwLocalRmFile() via crafted\nfilename affects Vim \u003c 9.2.0663. (CVE-2026-55895)\nOut-of-bounds Read in Text Property Count in Vim \u003c 9.2.0670.\n(CVE-2026-57451)\nOut-of-bounds Read with libsodium-encrypted Files in Vim \u003c 9.2.0671.\n(CVE-2026-57452)\nPowerShell Command Injection in zip.vim via Crafted Archive Entry Names\nin Vim \u003e 9.1.1783 \u0026\u0026 Vim \u003c 9.2.0678. (CVE-2026-57453)\nOut-of-bounds Read with Text Properties in Vim \u003e= 9.2.0320 \u0026\u0026 Vim \u003c\n9.2.0679. (CVE-2026-57454)\nOut-of-bounds Write in SOFO Soundfolding in Vim \u003c 9.2.0698.\n(CVE-2026-57455)\nArbitrary Code Execution via Python Omni-Completion Docstrings in Vim \u003c\n9.2.0699. (CVE-2026-57456)\n","status":"published","published":"2026-07-10T15:41:14Z","modified":"2026-07-10T15:45:04.007440114Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"USN-8500-1","title":"vim vulnerabilities","description":"It was discovered that Vim incorrectly handled path traversal in the\nzip.vim plugin. An attacker could possibly use this issue to overwrite\narbitrary files. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04\nLTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.\n(CVE-2026-35177)\n\nIt was discovered that Vim incorrectly handled depth tracking when\nprocessing spell files. An attacker could possibly use this issue to cause\na denial of service. (CVE-2026-55693, CVE-2026-55892)\n\nIt was discovered that Vim incorrectly handled filename escaping in the\nnetrw plugin. An attacker could possibly use this issue to execute\narbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04\nLTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10,\nand Ubuntu 26.04 LTS. (CVE-2026-55895)\n\nIt was discovered that Vim incorrectly handled length calculations when\nopening encrypted files. An attacker could possibly use this issue to cause\na denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu\n24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-57452)\n\nDhruv Vishesh Gupta discovered that Vim incorrectly handled quoting of\narchive entry names. An attacker could possibly use this issue to execute\narbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-57453)\n\nIt was discovered that Vim incorrectly handled bounds checking when\ntranslating words through a byte map. An attacker could possibly use this\nissue to cause a denial of service. (CVE-2026-57455)\n\nChenyuan Mi discovered that Vim incorrectly handled docstring escaping\nduring Python omni-completion. An attacker could possibly use this issue to\nexecute arbitrary code. (CVE-2026-57456)","status":"published","published":"2026-07-02T16:46:58Z","modified":"2026-07-02T23:00:06.16685198Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}